{ "analysis_details": { "creation_time": "2017-12-05 16:56 (UTC+1)", "execution_successful": true, "number_of_processes": 14, "reputation_enabled": true, "termination_reason": "timeout", "type": "analysis_details", "version": 2, "vm_analysis_duration_time": "00:05:24" }, "artifacts": { "files": [ { "filename": "C:\\Users\\CIIHMN~1\\Desktop\\MSC000~1.VBS", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\desktop\\msc000~1.vbs", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "STD_OUTPUT_HANDLE", "hashes": [], "norm_filename": "std_output_handle", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\vwOrbzLbc.exe", "hashes": [ { "md5_hash": "5da21af74810e3655bcbbe40660f21b8", "sha1_hash": "60d60dff0d3af3b564e43bc87ef5a63ff6146da7", "sha256_hash": "c0ce6c2f03e3174d347eb2136a230883a725fcd5179221f61435ea709a2ba81f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe", "operations": [ "write", "access", "read" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Windows\\system32", "hashes": [], "norm_filename": "c:\\windows\\system32", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "\"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\vwOrbzLbc.exe\"", "hashes": [], "norm_filename": "c:\\windows\\system32\\\"c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe\"", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "STD_INPUT_HANDLE", "hashes": [], "norm_filename": "std_input_handle", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\vwOrbzLbc.exe", "hashes": [ { "md5_hash": "5da21af74810e3655bcbbe40660f21b8", "sha1_hash": "60d60dff0d3af3b564e43bc87ef5a63ff6146da7", "sha256_hash": "c0ce6c2f03e3174d347eb2136a230883a725fcd5179221f61435ea709a2ba81f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe", "operations": [ "write", "access", "read" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\nsgA12D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsga12d.tmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\W8nb", "hashes": [ { "md5_hash": "5a028c895aaed43a1f4f16e880f83ad1", "sha1_hash": "4cc8b9e59434eae65374a5b790ec98fbab713871", "sha256_hash": "abed74c65d9b1562c2c9a10f35965d62f251742762cf28ca5dbd7813a9428db4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\w8nb", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Windows\\SYSTEM32\\ntdll.dll", "hashes": [], "norm_filename": "c:\\windows\\system32\\ntdll.dll", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\nsgA12C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsga12c.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\nsmA14E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsma14e.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users", "hashes": [], "norm_filename": "c:\\users", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\nsmA14E.tmp\\System.dll", "hashes": [ { "md5_hash": "3f176d1ee13b0d7d6bd92e1c7a0b9bae", "sha1_hash": "fe582246792774c2c9dd15639ffa0aca90d6fd0b", "sha256_hash": "fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsma14e.tmp\\system.dll", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\BOOTNXT", "hashes": [ { "md5_hash": "dd4c03d383fa84a8ccba73e0b34a26ca", "sha1_hash": "7cda05877b6effc0ea603a0925322fde261c51bf", "sha256_hash": "2f1a8b66d168474c99923af0795a35c2cfe9386f64b8000fa24c6fa3402f8a90", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\bootnxt", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\BOOTSECT.BAK", "hashes": [ { "md5_hash": "351a1e2354f9c0ccd36e00b75bb50a18", "sha1_hash": "e19f9661239c4fc761385ea3f39b00c9c2c35cba", "sha256_hash": "6f8e024373a23c013124ae16c0e7b38f583e44a252860f4c8380de99a38a9904", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\bootsect.bak", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\desktop.ini", "hashes": [ { "md5_hash": "03fa1e0ea94f96e88df614abbe0703b1", "sha1_hash": "8b6bf3c2e93724a603abc372e772fd4c8a1a154b", "sha256_hash": "237e277cf6439d70c327f263cb443e4b9f23e1736ec5e38d7e9c5a7490626473", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\desktop.ini", "hashes": [ { "md5_hash": "4557a99c5f04dd51e1c57f88eecabfd0", "sha1_hash": "12b9d3fd9c7b25af9f6030245a9bc7b9a306cc6c", "sha256_hash": "87d3ef818691192276efef80fb2d80a1c3f14d4313fe59566429b9a45a62aa82", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Videos\\desktop.ini", "hashes": [ { "md5_hash": "912937c3c9a69c32211d4162d9199fbc", "sha1_hash": "80e00a9c04a8cb36846da3917dcd095811cd586f", "sha256_hash": "d2f030314ae9d645cb32763ac0b66125eb38d718a64fddc090376eeb540e07a9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\videos\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Pictures\\desktop.ini", "hashes": [ { "md5_hash": "84033410a1053c63dedc29d312a02fff", "sha1_hash": "a98610896d90d8323dc68135e79b714f585619b3", "sha256_hash": "120db3e5232d5ac034a29d84bbc28e14b7fd08333b515574643d086152052dbd", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Music\\desktop.ini", "hashes": [ { "md5_hash": "19df54bac0c5e64d04110ed7d79e8a14", "sha1_hash": "3bc9092919086b28b62ee2e0ce7096b7e43a9934", "sha256_hash": "e7b4f0156e9e228454ba99d32e680487e680c7c7996cf48709ab54a2f42feb38", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\music\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Libraries\\desktop.ini", "hashes": [ { "md5_hash": "14f972c6f596015135491f8d195c6999", "sha1_hash": "aa46c370e3f5d5119f63168eef8c897f1947eece", "sha256_hash": "7d0f57e87e3fe8795d13be2e4f2cf9d4a2c15afab4aa58929dbd517077ae520e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\libraries\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", "hashes": [ { "md5_hash": "e36f7f7f6dc87e0af8a6b625daa9899a", "sha1_hash": "e846d09023adbf67887ee86e8a01b32f826d94ac", "sha256_hash": "48ae42aa9a9bd8731f6d7b5cac820121c4adacb024ba9e772d6738b0928b61d8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\libraries\\recordedtv.library-ms", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Downloads\\desktop.ini", "hashes": [ { "md5_hash": "334326f2445576654b881ca75881a12a", "sha1_hash": "2154f40bf4c4189c8d3e963b05c853e4f2df3b12", "sha256_hash": "70b9f46cd1678b6200e585463d78b91d07ae8ca9f254590fe1d5ce152f6f770a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\downloads\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Documents\\desktop.ini", "hashes": [ { "md5_hash": "fb9580698701e27432647edd2d7eaac7", "sha1_hash": "6781d39960831bab710c05f590166323646eb7da", "sha256_hash": "acce99a2039dd0fe6a4256f06e4ef93d4585828d8394bbb4aa8a4eca014888bc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\documents\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", "hashes": [ { "md5_hash": "8fdc81b4323f97687e071a50b5267496", "sha1_hash": "d36545d6fd09f7c2b574b68e120250347715a28d", "sha256_hash": "ee9058e027d4eb75fc3f979f72db86413401287e4aa18d33e073aed1b1e8547d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop\\acrobat reader dc.lnk", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Desktop\\desktop.ini", "hashes": [ { "md5_hash": "9dcef2ab01e7b4f41c0de6a3df60f5b4", "sha1_hash": "c685c2f13bbdc51b92da09c4382477e0aeec75af", "sha256_hash": "f3f0ac0332a1aadae365c1b4afca95d14e4fb89d56a47ba7582ca72d40aa1cb9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk", "hashes": [ { "md5_hash": "5e48a236139104b9b82eeb16cb72e0ae", "sha1_hash": "9b30a2145e9be12747754935fc14661731c1e125", "sha256_hash": "19d7b1b55ce79827f37860f46180bddaaaf35dd465eb4daf3098638999ab4ab7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop\\google chrome.lnk", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", "hashes": [ { "md5_hash": "ae617e94bd982a4ea563ede72ecdae37", "sha1_hash": "0d82d70473b3bcd4d3b1f525f6d86f4e1795dce8", "sha256_hash": "49d51bb8135ae652b9a764971120d484158e06f18efabf29543cd0d6676e57e8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop\\mozilla firefox.lnk", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\AccountPictures\\desktop.ini", "hashes": [ { "md5_hash": "efa39eb41053ff0a991c991975875bc0", "sha1_hash": "5d2c35f8ad96ecda5cebb27ea0f8885656c1038e", "sha256_hash": "5c4d71bd487cd675b674e5774c8cf24bdf86a8dd5204ec75693ea5960d20e216", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\accountpictures\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT", "hashes": [ { "md5_hash": "d83dcac774dee521012189dc88cc3662", "sha1_hash": "0ab64335840bacbf8cfcf5deaad8cd0ee9f853ff", "sha256_hash": "5dfdb0284b4c5a586857ba6ddf5ac921171130b346bca2ff034c47b7d3a68d47", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT.LOG1", "hashes": [ { "md5_hash": "9b22fc5462ac88989eac80428326c8b4", "sha1_hash": "de37ccf141aa88e2b36823c7f264dad2ef879d13", "sha256_hash": "0bde45128964856c98d7e041a6f984193f5e2fef9f6e2bae2fece8b8f4dda676", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat.log1", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT.LOG2", "hashes": [ { "md5_hash": "0e555c1eade9bd288351ec55ece64351", "sha1_hash": "d8088abab0fa629c0a2ebd85b09495d004a55eef", "sha256_hash": "13e5d77a28442e6a35c101086e296861f4ea614b314da9d0fa7a9e098a8c7afc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat.log2", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", "hashes": [ { "md5_hash": "57f5d78a1ec92fde51f041dc00d88054", "sha1_hash": "014d993b9c714e98da5f6c99cd385ec74353784c", "sha256_hash": "79d7a87a7868d9fa9c931d396517e6cdcd3f7c6dc3c6ba5110693181eb03fc7d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tm.blf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", "hashes": [ { "md5_hash": "48edec9d8fe3890abc8a341cf0a24a3a", "sha1_hash": "9ec639610f86974fa0f04d099995ab77e3123dd3", "sha256_hash": "2fa43cfae372a2f004aaee09c314d1641c334862115636da0aa35f5ede3c907c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tmcontainer00000000000000000001.regtrans-ms", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", "hashes": [ { "md5_hash": "57b2afe19de2c0e01e104353ce5c97c6", "sha1_hash": "dee459ee5a30f2ff682188a4d33e1c7ef200774b", "sha256_hash": "07ea3cf325f425abf86e54b86ec9924ea3c9d1cdc9f3abe1d0d4e4314d7212af", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tmcontainer00000000000000000002.regtrans-ms", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini", "hashes": [ { "md5_hash": "1524c23e29ca650fee428d62e876b108", "sha1_hash": "234adc81a95746aebf2e5f06f6fc63b13d3b814c", "sha256_hash": "a9a2ad3c5c92a5dc415de2e8578ca9d214a958f7b46d8dcd988d4503cf9e546b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\ntuser.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", "hashes": [ { "md5_hash": "bd3d4d5eb25d64e78a8dc21a5b0ce4c8", "sha1_hash": "5a860bd27a305d6e6af9b8d406836bcdbd0c3d46", "sha256_hash": "874beff6a5c1aa61d7c49a25dc23a22eb7b0aecf5cb5b45b455afb0f9d8b52f9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\E2waSdX2n_.flv", "hashes": [ { "md5_hash": "a6d96e199780925d81c91bb4fa149841", "sha1_hash": "2f73ba8ed8f14895d10cd2ecdaebe16029c30df9", "sha256_hash": "2f0627608232265a780eae15074fba5f7be01b0a4c5e41c0446e1d75fe69d9c8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\e2wasdx2n_.flv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\iBTwm8.mp4", "hashes": [ { "md5_hash": "869d0badcf60e04ecc2b218ed188b179", "sha1_hash": "6887e6ae6c26e10ef141116a800aaeb571cf40e6", "sha256_hash": "172284c36a0ac87fb5c30ff25ae5f18efee95ac312fe773b22785c795ff3645b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\ibtwm8.mp4", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\NY17G87uN.mkv", "hashes": [ { "md5_hash": "c0d2b4ce573c4b64c6677f6bc37c7415", "sha1_hash": "162bba83fbbfe53f338d365cb2b95e54cdf9bd5c", "sha256_hash": "79985aa176fd5b4a528a40efbfe9cecbd6cccf6c168123134e4b7566eaae05b4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\ny17g87un.mkv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\P1l10Vzx4hd3-C.mp4", "hashes": [ { "md5_hash": "c4fcb29035a817cc14f45304c4d2490e", "sha1_hash": "d37b16597503b5bc72dd20ed9b0061565bce7841", "sha256_hash": "4c13bd5c2a840fe2698e48900d9e5a2d225018410104ab0739a6ee816197c36e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\p1l10vzx4hd3-c.mp4", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\U8xibbuO9vCag.mkv", "hashes": [ { "md5_hash": "ef5e1f614a58744f99a63faae1f07cbc", "sha1_hash": "ad87228795e5c5f35f0beecae9535607c3b6ad2e", "sha256_hash": "2f0538dcb5a3fc252bfb660e65f218f482491202bc4cbac19e7f295507c5d1d8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\u8xibbuo9vcag.mkv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cpcCB0B.swf", "hashes": [ { "md5_hash": "77c363aa0b79f3d0d3668d81ecb9141d", "sha1_hash": "a6617a5f0203ea9c75a3012cbae6ab87f497f31f", "sha256_hash": "0e02cfb29fea57bc04a3c47f50279cbcd2b82bc0c8e71d36413805de1c73bb6f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cpccb0b.swf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\pglUhoTAS6kwMMFsDl.swf", "hashes": [ { "md5_hash": "2ef50514bbdf5c1fb1d99df1003680e4", "sha1_hash": "f00a7c057ca940e40c09389e96080ff1d23300c2", "sha256_hash": "bc12ad5610ac4c5278903dd2afd1c8c66180a1c519ed54f4c998c8f45124de70", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\pgluhotas6kwmmfsdl.swf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\6e5-HpMrbS.mkv", "hashes": [ { "md5_hash": "224edc872eacbcafe10cc214a8d8f606", "sha1_hash": "44217fb10c26be8043cb8e1f8995a7a0616d948a", "sha256_hash": "f88670028a1bc60e4b18741205e4d4a34f8cf076bc2a4d00e4c1e8b55619383f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\6e5-hpmrbs.mkv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\6gwG.flv", "hashes": [ { "md5_hash": "7727271b003ab118e5a7ee4f46935aa0", "sha1_hash": "06f4b83bf0e1cd5fe9a338e2d436627c4f634555", "sha256_hash": "6f53372a64e6aa4a87218501439ea4d762b340e2c876ed860b40d58d71b2dd92", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\6gwg.flv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\gxfzekk51.mp4", "hashes": [ { "md5_hash": "2c531982707a0d2bf59074d62157b4b4", "sha1_hash": "2293b64dd2a55424b9324ee43e81126f8118e585", "sha256_hash": "62dabff92059c12969278fa6d0cd937db0c421bc9bf2d03b1862760d83749382", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\gxfzekk51.mp4", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\lI6eAu1sqq2.mkv", "hashes": [ { "md5_hash": "cc3026377aba30e4133e5fce0bb76937", "sha1_hash": "157b1734ca63de36fba45139b374d21786bbc389", "sha256_hash": "47e13837c48b5d49d11675d8e387e57504166d0957c68d17cb5a03cf591e5bd1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\li6eau1sqq2.mkv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\P17XSZAU6p5neX19v.mkv", "hashes": [ { "md5_hash": "22b8453bc206080fbca0de949a9bff50", "sha1_hash": "a5dc55caddf3c00c8ebe8bd5c703256bad2da952", "sha256_hash": "1600762b28cd5fd906eec2d17dfcaba6fdd1d47cedc7c3e0dca77645667eca43", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\p17xszau6p5nex19v.mkv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\qopWQzK.mkv", "hashes": [ { "md5_hash": "0b1b91e03ccdf4eb9f73ee409be5e17c", "sha1_hash": "9a0def13f02c4680d9bb499e406ee70049789591", "sha256_hash": "09c06b2417d218510ae018c5572d9a6e473f7754f6ed606e960d4fe46bbc743d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\qopwqzk.mkv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\u-MJrV.swf", "hashes": [ { "md5_hash": "3349fa04afe142e3b99cd9812bdbd1e6", "sha1_hash": "7236a7fc759079d2bb585a4965abbf117ec7b37f", "sha256_hash": "3d6909f8e1048412e03a1e0b5a7154a7d7a693b6e95840098229dad9f0637f20", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\u-mjrv.swf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\wyRSSbqc98w\\JNgBvbxt2TE.flv", "hashes": [ { "md5_hash": "16c7ee5f1fa526ac4802dc6b46685f2c", "sha1_hash": "763d4427b0d6e6b2b7ba36516c8b98296b18aa92", "sha256_hash": "307ecdb45c3220a1d9db865e5cd134b219525614fe2c5850504134fa0891b750", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\wyrssbqc98w\\jngbvbxt2te.flv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\wyRSSbqc98w\\XfNky9jsklLvnZzA0q7K.swf", "hashes": [ { "md5_hash": "8e55130411fb86e461cac2b1786353aa", "sha1_hash": "a5fc0bd86905e48f5f8ebb054463e4671f3213e0", "sha256_hash": "ba3d8c13f3de0bde5ed1a4154c9f8de820891a8234c49417577feb9e2bbdccd9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\wyrssbqc98w\\xfnky9jskllvnzza0q7k.swf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\cn620-GsIa4nYYYCofJ5.mkv", "hashes": [ { "md5_hash": "94fbaa99139c9d10a02bfc36ac9de466", "sha1_hash": "bc138ad598b761a24e0d0013cf64d86dc4fc140e", "sha256_hash": "b1e9c09cf2c3eabc1c4c394d756385daf0ed24b4c23a68d646b660fe6fea512d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\cn620-gsia4nyyycofj5.mkv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\tt_X88h6 PABCl7r-.swf", "hashes": [ { "md5_hash": "710e3b7a9024eaab14b0f4ca641b75d9", "sha1_hash": "a10e5dab1ca75408740ce320a4ffa30703ff4855", "sha256_hash": "f967457c20a83bece1ff8ab326cc7b6354c8f5ca9d37daf0c9511e6a4665faeb", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\tt_x88h6 pabcl7r-.swf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\z5nYgQLxCnl5CC-.avi", "hashes": [ { "md5_hash": "aab7e0c401e157c1c2578244eefe5fab", "sha1_hash": "c238e5b64433873f13430a7d7210779ac149145b", "sha256_hash": "8364c334ff92f20ac6b24b1d8bf77b98421d16143a6edab55dc938b2a16743de", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\z5nygqlxcnl5cc-.avi", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\4tNMmqDfQUCo23LOg.avi", "hashes": [ { "md5_hash": "c3b8766fb80ddf42509e7f761928dc30", "sha1_hash": "b4d33f1cf53cecca4886ce8d2dc5e4db905c0a01", "sha256_hash": "8e61c5186a0dfff841d34d4dedba3589455dc0f82dffb09b3a809403ebf5d29a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\4tnmmqdfquco23log.avi", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\9JZc.mp4", "hashes": [ { "md5_hash": "4a6889191bccb24e074c8c8c38412edb", "sha1_hash": "f9b029cc2c1a8d832a6a3db9249ad9a536eb53ec", "sha256_hash": "2a526ea714599dcacb6bbbbbd4caba2866f483b2b8484a37a0855db68c9e19c0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\9jzc.mp4", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\fWOL9DBWif.flv", "hashes": [ { "md5_hash": "7ca5c244029c3c8be3219c37cc5c6fa5", "sha1_hash": "df6bea5d708fb2afe2052673928401fd946d62af", "sha256_hash": "6face97dd1e3c6aef75551648680b05a670e34e8824462b68d627ccce635e418", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\fwol9dbwif.flv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\O8eEM2rfs_MY3eq9rG.mp4", "hashes": [ { "md5_hash": "ba8ccb3fdcee2914c38bce0524e842b8", "sha1_hash": "65e64716db0da062105d70ba2afa2ecff90fd9c2", "sha256_hash": "f8d7120d341931fbbcfa46124bd7192f7dbc2f10d5e7d6bc33eee61c5cfa052b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\o8eem2rfs_my3eq9rg.mp4", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\s0d9d09EsgnYM8FvdWh.avi", "hashes": [ { "md5_hash": "bd974c8625ad3b525bfcd5bc7ca38035", "sha1_hash": "cf8d51a8866500327d11a32696c56b6292be4561", "sha256_hash": "19f5df5f700308b91eb93b30ea24fee2c5bc10f2a74a357b97d244d619871097", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\s0d9d09esgnym8fvdwh.avi", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\dINDjPM.mp4", "hashes": [ { "md5_hash": "4ae1c4e97f55af4e88994edcace7da04", "sha1_hash": "3529e9ca4db6e2dde3252cb17311ffb48bff3801", "sha256_hash": "a777066c67f3326bd8de19d3d77345345d7ca1e7720329267caf479bc0368495", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\dindjpm.mp4", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\GppAg7bkp9yD0gqXY.flv", "hashes": [ { "md5_hash": "36950664f74e1b45f63a64ad3198c4c4", "sha1_hash": "72fb97c7ca9c532b0d374e13d3edd23528b93230", "sha256_hash": "1a2b8b094e6ad3f6a08229865269e08f1f6b7addfbdf0cc8eb5d2a812e97ac30", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\gppag7bkp9yd0gqxy.flv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\gX_wpIDL1D.flv", "hashes": [ { "md5_hash": "fc1b8206ef863f678da28ae60ff32324", "sha1_hash": "ac7999e33a532a057f2bc5c5002cce9139377fc1", "sha256_hash": "1f314cf51e1aa8b12f451de8f0b25133200e20e8562e8c1e3cddf5305e91e0b0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\gx_wpidl1d.flv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\nXLOUPBUSENPl3p-\\WnVoa3g9JP.avi", "hashes": [ { "md5_hash": "a937f1f839db02afb42d1607d1ded6e0", "sha1_hash": "3e0379560c88f8c49c9bf53d4a2567996f17b929", "sha256_hash": "4f33edcf69278ac37b940a4eda0741af35ba6b54d261723c27518704e82676f2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\nxloupbusenpl3p-\\wnvoa3g9jp.avi", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\8kLT4Ds_WbYAiWWTJ\\29fvAWN e8KITEzwwn.flv", "hashes": [ { "md5_hash": "43ec61be6fd526095167936b71b9c80b", "sha1_hash": "e60eaf40ee03bb331bf4f80570e2f91048e553d4", "sha256_hash": "2e6d24776764e1a69b4cf04bbe6938b2fce888d9e0a4d92086bb7c10ca2745d6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\29fvawn e8kitezwwn.flv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\8kLT4Ds_WbYAiWWTJ\\a6mtdOtp8JU.avi", "hashes": [ { "md5_hash": "3608a2b7bad77eb62fa08acc7860790b", "sha1_hash": "1fddce70e9c76b8e19e6a8cdddb037b93816aa9a", "sha256_hash": "4f570434413579e169995ce8070bf8d8532d0e6bb283e81e3a13d01889815f69", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\a6mtdotp8ju.avi", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\8kLT4Ds_WbYAiWWTJ\\eZSH9_U.flv", "hashes": [ { "md5_hash": "9592d4228871918fe89dfd41f35f2519", "sha1_hash": "576536644a6cd6cef1ebd34f0f61f6332396b24f", "sha256_hash": "7f449b69ec6e80ef67ef543350e12f2af51a60d7e5a3a89d404f822ac7c5ce8b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\ezsh9_u.flv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\8kLT4Ds_WbYAiWWTJ\\WALJYrB.swf", "hashes": [ { "md5_hash": "9054674649197d9a0c4cff7331c123f4", "sha1_hash": "9de74aa70b9160dcc0454a2b60cd84c6960635c6", "sha256_hash": "a4c07abb692ab47758373a5430088a0fdbc7a5328eaac1f0cf8f5d9439b9001d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\waljyrb.swf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\AUvU5OO_3GglwZKK.mp4", "hashes": [ { "md5_hash": "59c24a41d3b59a62c2332684cdf7a2c9", "sha1_hash": "b3d8f3ba307b40c3d24350621282b6a707fee3d1", "sha256_hash": "377ae13f6d315cb476f6b2e70531ee2b56e4b479b8afe2a0e4f7d50329c91673", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\auvu5oo_3gglwzkk.mp4", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\kMLEB81EE9b5N1X.avi", "hashes": [ { "md5_hash": "998056d7bb4782afc1fe5dd83831b349", "sha1_hash": "a0d8bdccfeb75d91c92c37ef9c8e27270ca66123", "sha256_hash": "e57bb617df558bf06851dbead8bb94a488a7d59f0585d9b6d303737e76212765", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\kmleb81ee9b5n1x.avi", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\nMnO7w-y-y.swf", "hashes": [ { "md5_hash": "afbc6aae9a38e174bba006c3eed12fb1", "sha1_hash": "8e2afec244434d71356ce99f54eb2a060b186fd4", "sha256_hash": "d722f4cc88e9845f795364929d9a39dfe3dceeb94a6178c498d5fc984797d047", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\nmno7w-y-y.swf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\AJr9qN-J2iQXFfFEuVm\\fvNQxqgywuA5.swf", "hashes": [ { "md5_hash": "08cf7a35d11c46ef9f2636134600a86d", "sha1_hash": "2ca70859374af74b538e9d2dee9aa5c6f07076a4", "sha256_hash": "d7207d75687dcc2265408367f777e000e2ca602cc61940275efa6bc1dfbae30a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\fvnqxqgywua5.swf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\AJr9qN-J2iQXFfFEuVm\\INOm_Uv1I78K.avi", "hashes": [ { "md5_hash": "3f0d9b18e92cddfe21eb116820e72a56", "sha1_hash": "8f78ef7d1c1cc1458b83ac4f6f845449a9464bf9", "sha256_hash": "dd2ce7ba60461cb0302fc03576843773928d1fc4d13cf480ca79c2b516825a3d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\inom_uv1i78k.avi", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\AJr9qN-J2iQXFfFEuVm\\l6wYbM_D_r_.mp4", "hashes": [ { "md5_hash": "df53e775ef95e9d4c47ff79c72935cc1", "sha1_hash": "53ed9157075b7aa18ee2abec0419a623c4acd2a5", "sha256_hash": "58c9eb8125df9d1653c419f73e3dc5d0528682a8bd74a47209ba75802c678fd6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\l6wybm_d_r_.mp4", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Searches\\desktop.ini", "hashes": [ { "md5_hash": "c4c1f7faeaa84afea0455e3ad7466095", "sha1_hash": "f53b0cc38d4f8c6b30926e357e63d6cbe5d5166b", "sha256_hash": "7fc129f00a30303e0fae704350f13d9534be76909e6961261677e3b75d960a80", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Searches\\Everywhere.search-ms", "hashes": [ { "md5_hash": "67a89b1d4df7926bb1282fa543e092f0", "sha1_hash": "db060cce54618b30a81ef32e3ab32413cc98df51", "sha256_hash": "0f7ad004fc0f95aea113801039197f9c33c45f1953356bb603ab97c109396cd3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\everywhere.search-ms", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Searches\\Indexed Locations.search-ms", "hashes": [ { "md5_hash": "9f661fc1d668f3df14e769547e7beee1", "sha1_hash": "c7fc75a79d8556a2c8862f39a7bd13df6d800be1", "sha256_hash": "e81325733aa1be43630ecd9a9cba0cc6e69b9bf71ac8262233e05e8500eb5cdc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\indexed locations.search-ms", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\desktop.ini", "hashes": [ { "md5_hash": "d2c3bc6c2e874a4e62d5752742d6a26c", "sha1_hash": "fca1d2e592d8698781d386f7ce2d310384c5853f", "sha256_hash": "2268250d88125d513d73334d7ecfd5c0ec075c5639646ac99e17bf8220e96c67", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\saved games\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\0hK3feRWLwMDEGNQX0.gif", "hashes": [ { "md5_hash": "ac9f3f9c26338af80c9ba05a1b5f64b0", "sha1_hash": "e43e831e8a6648909cc0480f02a6a1423f148ca2", "sha256_hash": "d2688170b4418761121d914e2c7573fbbe6b326b9544be772c99d3ae547efbe1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\0hk3ferwlwmdegnqx0.gif", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7QDjRW-YOMo-k-Z7n.jpg", "hashes": [ { "md5_hash": "2dbb0b4cb0b8acf258f575c13848af0c", "sha1_hash": "4a2c061fc5e340860ab6b2f16d5f2ad1d62e2e82", "sha256_hash": "e6dfb245a478614c79c30c89345670b51f6182c37bccc7ce258d19076ebc8d4c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\7qdjrw-yomo-k-z7n.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", "hashes": [ { "md5_hash": "3dbf9c15339199ca1e20853ace4b31d4", "sha1_hash": "c9b06d0f911c553a516f1e3066fcd1f3af08a473", "sha256_hash": "4d8b6c410fde466c6a91419bd42ff117b20a0142ecbf655f2b5c7e18e2b30157", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\H7tRdZQ_5G.jpg", "hashes": [ { "md5_hash": "7caf7deb64e49cce7593c857445d9707", "sha1_hash": "8245ac00ca2d1977b65a96d15aa601001ff58199", "sha256_hash": "6bdc520d1fa0813a5849e335f463903b59082bbac8a66c5143c26cd9b539fcb9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\h7trdzq_5g.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qRw9a SAHnUzYrBRoXD.png", "hashes": [ { "md5_hash": "bef17db6f8008201e2eee7fd8215e509", "sha1_hash": "ca910c5addc99824de22d683676ab0e7bbd0c802", "sha256_hash": "6255803a4dd36fa4b6b32c5152151fb9414794203bcd7b676c79d12731a1cb03", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\qrw9a sahnuzyrbroxd.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qTvKCWKzZwIBwteiqbM.jpg", "hashes": [ { "md5_hash": "6221a08d21072faca2c26a7097305663", "sha1_hash": "339bdab658b3cee4b1dfbd555d67b97fa002a177", "sha256_hash": "f5ff60ac82babbb8ea59c7690f6ed00abbd182317eef555b0864a53b2e802b3d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\qtvkcwkzzwibwteiqbm.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\th8eU.jpg", "hashes": [ { "md5_hash": "cb536c6ba05ad084eff49534b411798c", "sha1_hash": "791af3ac7e44f90ef0aa93c3c6aed09210b47f19", "sha256_hash": "616f462f32179ebad3ccc620412868de4ff8653e13f2a0f3407afc4c3d4707d1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\th8eu.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\XphR2TJjz.gif", "hashes": [ { "md5_hash": "6ffd4e7f9b56f035a66f15814759b63a", "sha1_hash": "2b1d5c41a36841dce08c429493aa8041277a6029", "sha256_hash": "3271d5f78d0e0a9d15c4c0434ae1beaab48fdbe953f649d7be9dfae66fce2f7c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\xphr2tjjz.gif", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", "hashes": [ { "md5_hash": "b0d042871f93477b4b37c70d7629837d", "sha1_hash": "66ef0c636edc9f29d4ccf63034dc37e8ebf88ec4", "sha256_hash": "af01d088ccd7258d620311b66d6308413f9a5b618df0a162b66461913890d241", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\-9fnhCfha2.png", "hashes": [ { "md5_hash": "a8594fdd545b6bb17c417f4873165714", "sha1_hash": "a886b4e80fd4f7e4e1c6f891c045b38ab0997118", "sha256_hash": "748f2bbfb8824b5e10ae6479c549f6f69647d25377479cf85b58529ddbae894f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\-9fnhcfha2.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\9XuHi63.bmp", "hashes": [ { "md5_hash": "cba8de21ea1a126cfdc94024e40f0f55", "sha1_hash": "46e1f7efd4a53808d430e12adfd8728f315abd60", "sha256_hash": "f4d65c1671191464475c8d6c7f61bf0d8fe07be14bbb27977cc3670f0612445f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\9xuhi63.bmp", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\HKqhG.png", "hashes": [ { "md5_hash": "12d9125b7719dd59f98119fcb76c7cde", "sha1_hash": "982c5debeded46dfe4e4a251971702301159bbca", "sha256_hash": "046e39766f992c5785cc76142a09abe4fd9b305a4a0e0140a6c8370b455740f3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\hkqhg.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\qhasofuRdPJwbI.gif", "hashes": [ { "md5_hash": "30578e80f0a80370a8c6d465f0b1a195", "sha1_hash": "6b3b47784a3652ac50e44ac130d71389ea8a1e0e", "sha256_hash": "b930acfbd9d9b5cef9f2e53d1c84765da1a6990c42e78fe247e944fc3df4caa5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\qhasofurdpjwbi.gif", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\x1B_.bmp", "hashes": [ { "md5_hash": "5b0b91210560fe6519b94a7b619c691e", "sha1_hash": "f0db99e5d5cfc01b857635cd9a84645f36ddd0df", "sha256_hash": "9c64bffd9d021a4292cc55882a66fe3c6b7b7f4288fe1fba6603618de6168d0f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\x1b_.bmp", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\as7LziUTZIvnQsdmiXNj.jpg", "hashes": [ { "md5_hash": "5e79772c1bf60f453460c5abc32d5257", "sha1_hash": "d040eccbbb921c559a00c81c2c9ef27f7a858bc4", "sha256_hash": "52e64a74db7f147f4477d73874694bbdc93daf35f83e04fdefd806236b6098b3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\as7lziutzivnqsdmixnj.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\D_Fv7 PRSX.jpg", "hashes": [ { "md5_hash": "0539fa8eac70342f38f39a2aff0b53b9", "sha1_hash": "a798f721381034bebe68604bdbe2a66366a29705", "sha256_hash": "94e9f7d040b6f5608c78adbae3b61bd895e3b49e7edc0f97b227d620aa2eeb47", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\d_fv7 prsx.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\kOVNpDMYRL.png", "hashes": [ { "md5_hash": "53ba80cd0472f0698fd1aae0d73ae925", "sha1_hash": "9015b1b9c7d81a959e33946dbc4bc036cc7a4457", "sha256_hash": "48f027c9baf7222c23df41960d3780f75b4f169640f35b92be2cd2651c96a3ce", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\kovnpdmyrl.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\UgMctukfcXoBe.png", "hashes": [ { "md5_hash": "077d2fac723f1cbd3d6bdfc1fcccc4b7", "sha1_hash": "c97904a3ff6a9e73ad38051e05e87decaba9a221", "sha256_hash": "7d919692580b8bd577a1360c5506249a580d1ffb78bc03f2cc07ed3f6a7e4f9f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\ugmctukfcxobe.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\uLsDCVKQEuXlv ur2Xy.jpg", "hashes": [ { "md5_hash": "ff38a4f3373f37969a54c7ceb6223b9c", "sha1_hash": "22ddf8d15fc919b28ac880548c7fbf0d4b8aadb5", "sha256_hash": "de26b309e0ba1723040055c01ca175326fdb25658c5d4f2678435b16772834b7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\ulsdcvkqeuxlv ur2xy.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", "hashes": [ { "md5_hash": "5cca10bd6c111274005acf6f8db9d76b", "sha1_hash": "8ab4945701ba3219e2ffdb58726d345c4dd79d48", "sha256_hash": "bd7dadad415f1e07336a09ada99a12632c47dcf7fb5a6de72ab9eaa5044856ef", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\3kc4ZE4GwJhznR0Zwjv.png", "hashes": [ { "md5_hash": "e91fcc5a22a514f23ab756ab8e965e88", "sha1_hash": "50d754005ca12f35030bb9fba64998c17f460fa7", "sha256_hash": "d05103743b01d72da17f90cf0c1216ca7a9e01164df05337456444675c02b070", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\3kc4ze4gwjhznr0zwjv.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\8FsduI62A 2PMyaCYJT0.jpg", "hashes": [ { "md5_hash": "af89d4843dfef53adccc8dc0ef2a8934", "sha1_hash": "ba1d212d9e0133221334f84effe4ede67597d01d", "sha256_hash": "1131be65c1eba551c686f4ddbf5edd84f43f0b8720513530dea691e502479026", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\8fsdui62a 2pmyacyjt0.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\9n-4.jpg", "hashes": [ { "md5_hash": "97f431bcdb02fb152c69f0fe02419e3a", "sha1_hash": "fd31cbdc91fa71fb9f18e29dd506905f0d5ea307", "sha256_hash": "760a7a2b099cc37d79aca7c4a44fdb8a970d0224b4f69ba64fe2f3f0bf797eb2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\9n-4.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\BaYM9St _GUc-pMf1k-.gif", "hashes": [ { "md5_hash": "d7bf4fbff69ac4313be002d49c76f39c", "sha1_hash": "79effbc7a1827648436550239433a1bed1ac4f69", "sha256_hash": "1674d71148be864775ed3c1c68f6b6ade5ad27d3abc77314c90e6c00a5df3a51", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\baym9st _guc-pmf1k-.gif", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\dy4knw.jpg", "hashes": [ { "md5_hash": "542c2e3411ca3a681549cc1a98856d67", "sha1_hash": "01408887f8b4fca7dcf925b8245e4c15a2515a96", "sha256_hash": "58b689bb52fd767c33954049f14b10c91a6a5e148eb8104127d0161ad3a94b62", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\dy4knw.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\gFe4.gif", "hashes": [ { "md5_hash": "77fd1a6a20182d86d798362c119dc482", "sha1_hash": "2219754d4bd725d44bf411c526c41480bc120186", "sha256_hash": "1b378dd060e864fec50e1db866c4ecd212f948212c33fe804da903e8c2afb62a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\gfe4.gif", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\l6xsWM755meyJgKN.jpg", "hashes": [ { "md5_hash": "599d1503d5df5884c705682574796908", "sha1_hash": "67d2f2dbdd9e52832ee21483d65b390ca534c5a9", "sha256_hash": "54081f08d706f60074bdef6e7f8d10c61d2a80af9c9ba8378c7c2113ac986d44", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\l6xswm755meyjgkn.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\olgvHwYDQYI0LAKBu.jpg", "hashes": [ { "md5_hash": "bc53f8db3d2219662d16428f33bc9c3d", "sha1_hash": "42a4788a39c115d40c18c403c17c08927ffee412", "sha256_hash": "5ebb588dec0ad24e05480a2eae6bdbd0ad2650eb2b6e1447587cb65aab269859", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\olgvhwydqyi0lakbu.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\rjZGheo.jpg", "hashes": [ { "md5_hash": "4011b193c3ea477cbdb7878b5e6e4ace", "sha1_hash": "e365174a03247c97fc9ee07248498d3f860b80a0", "sha256_hash": "ebe9f6bcf0406f51ec1360024a0baf809abfc4cfa9c8f54e2acf6545eca4a6fa", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\rjzgheo.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\V_voeP\\5b OpcYK DpCOz.jpg", "hashes": [ { "md5_hash": "bf95a5b5530da4c567c457a7405ebb09", "sha1_hash": "62aa0ee530b1684ac4a3308d1a226c8a2b999a45", "sha256_hash": "975f8a21e4602b9515be89d331d38b1155f9259adc53e09f3e47707f91236b48", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\5b opcyk dpcoz.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\V_voeP\\ePXXKIHHqhnuU6fk.png", "hashes": [ { "md5_hash": "4c7f676d50a765b1c881721991fe70a9", "sha1_hash": "ff225983c83fdeac6d24e00bc28690dd9ebc0d23", "sha256_hash": "cfecb0949cb1b424b3b14aade255d501e8960e263d3a5311e896ed045f6374ab", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\epxxkihhqhnuu6fk.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\V_voeP\\PTUT.png", "hashes": [ { "md5_hash": "5ff39262daafd22d49661e9bbb4937fe", "sha1_hash": "cc287a3da490d7e841759a957fdec13e4cd82e2a", "sha256_hash": "796c0c58d34b7be60b69345a52494b8f3ff6261ae18323719503e17a125350f4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\ptut.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\-5LN7dOrug9.png", "hashes": [ { "md5_hash": "928d739af09a9f89057dbc12faeb53c2", "sha1_hash": "f35051ec0f0ee9850b1defa2e76b16027bb25166", "sha256_hash": "1a1169bfb1d5c2c7dc22af9cf6bd0745973a62b94c2b415598c747335a0996a7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\-5ln7dorug9.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\F0XHzrypqok3ky78oShS.png", "hashes": [ { "md5_hash": "1ab1ac77b6519d6d5e64284749dcb175", "sha1_hash": "2cabfec4627b0f99dc431fc378822716385c6030", "sha256_hash": "00765bc7e24a8493a7d6b86414551b3ba60a33561f631a3623b61aea3c578696", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\f0xhzrypqok3ky78oshs.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\i39wbFUmYP6Nr8Z.bmp", "hashes": [ { "md5_hash": "b44ff50eb8a7d805974b9d748c93fb52", "sha1_hash": "7c511012208b5d52b8610795bc4519f2ada50ab2", "sha256_hash": "ef5a76511fdbdd3bee2f4d07fad1cf1a1a805be55af41705faa2daa9daa51996", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\i39wbfumyp6nr8z.bmp", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\maZf5-.bmp", "hashes": [ { "md5_hash": "f0bf7f7c785877b62a459ffb5e32ebe5", "sha1_hash": "2535230322be3bc8a95c223aed64435dfead5cc6", "sha256_hash": "118fb7d5ede3c8190d5bb77935b2e3dd7026a03279099e7cdb00b1ff89b374c2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\mazf5-.bmp", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\tlHDeOF6PKJ-_ruMjy.png", "hashes": [ { "md5_hash": "04b3c7e69561c2888e7a5b84ab9f6d59", "sha1_hash": "e8a412c9f56fbe883167bd6ead7bfbd42fe9d44f", "sha256_hash": "d87875105600cd1c0aace4d8bf777135cc51328c22b204a295090c9a68e6bb7e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\tlhdeof6pkj-_rumjy.png", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\tq6haLxMyM.jpg", "hashes": [ { "md5_hash": "786713f927ab73bf30c7519cbc9a0544", "sha1_hash": "75676b5f9d301b1e37d5c1dc2ee5e82cb9ef5045", "sha256_hash": "4be5ad07ac1aa15652184451374b3b874826fb2d72643211aab4b92a94f8aaed", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\tq6halxmym.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\6GHFbg6R\\YDgP6n.jpg", "hashes": [ { "md5_hash": "f9684a45f6842e4b1cc3d62a8aca8d0c", "sha1_hash": "dcb6b5f5d6420e92473415630a11c074c865fb1d", "sha256_hash": "d5d0e1ac0f2c1b53ffab0344f4f54556ee059759fa7e64d61a8f952daa9458a2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\6ghfbg6r\\ydgp6n.jpg", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\desktop.ini", "hashes": [ { "md5_hash": "0072fd5678c831e896556403c9a56dc5", "sha1_hash": "e5f5c7cf7b6d6e5ae349dfb6fb2f02f95130a79c", "sha256_hash": "cc05acaabf026ed6bcd29908ae5079735617583855e4fd6557d8e310154af02e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\onedrive\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\-gv6hl.mp3", "hashes": [ { "md5_hash": "2c90f23fd3114719e5dbaa82caa89f90", "sha1_hash": "250d53eaf9025c4559cdaad0b27f7ed435f1a782", "sha256_hash": "ebb0613399cc729b99177b5ebec4f245500a6e66ab9a052f92910d6937d6f691", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\-gv6hl.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\a7bhmQQgp.wav", "hashes": [ { "md5_hash": "b0fa6eab862c042066dc38fad71cabef", "sha1_hash": "7d348ab645d083ceed008810414fa7ef7a44e201", "sha256_hash": "4fef77b6c8e7f4996e016a4e24c274e0000ee2e3f7efd1035b233bef8ab84ed4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\a7bhmqqgp.wav", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", "hashes": [ { "md5_hash": "c97099a5ebbc80d50d309d865880682c", "sha1_hash": "4ca5f47e27d62693879f719b542b2904b0563b56", "sha256_hash": "ad3c0c99182392975db23272978191ff9571c70e703c03a405338a777fc58be2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\FGplqZx T.wav", "hashes": [ { "md5_hash": "0c76019d1dd59733e76144c42f6bab95", "sha1_hash": "dc9544ecd70bbde7a47e1c8e0566a7cd56a77d93", "sha256_hash": "b58d31ec4f4db1e03b94ed836f0da1d41d8e7372525d6496b5ebfd8e132bafb9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\fgplqzx t.wav", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\dckF.m4a", "hashes": [ { "md5_hash": "b007a5506f60a4dd110bacf3020a385f", "sha1_hash": "293f8367e9af5a7fdc6c0236488f35e37d4efe47", "sha256_hash": "553dbc1b733af0c76ef0c3f3c7e922952243f6369c0d1ad8466168573233207e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\dckf.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\DsuPk7Zl9jC7_Qd.wav", "hashes": [ { "md5_hash": "e4093144803c7ad006ee5d2eae5cf5b7", "sha1_hash": "1b5493aa25f317782189d937ad5ad82a9559a407", "sha256_hash": "7b515183cebe5db526924ac367d388c1b837ab659c206cd5b099496a656cc2a8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\dsupk7zl9jc7_qd.wav", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iPpvCsEpbFWDeLC.mp3", "hashes": [ { "md5_hash": "f0ea0deefa136587fc6a510b1395a251", "sha1_hash": "368a7817564586557f049a96d4f24a32ddb462c7", "sha256_hash": "b8044b5eda6fbb828bddf30c03b8139cb8305c0d586d4b85f6e609ccc082259b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ippvcsepbfwdelc.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\OZuWUdusfQN.m4a", "hashes": [ { "md5_hash": "f27d09d9b1f2a01da155b43943031bca", "sha1_hash": "bba3aabb49cc0b4117c0b02e9cbfbe2aba2928f6", "sha256_hash": "ad5581fbde71925b779c79b29baa5e2c9979765981b5bfd5a363769352d45b4e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ozuwudusfqn.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\vnzuUiJUN.m4a", "hashes": [ { "md5_hash": "ac7657ac37ab2dad3dede5f0bb1907d1", "sha1_hash": "e78532985ce0a17447226d5d6529395226052e9e", "sha256_hash": "7dec2fd091ed96b53bdb35ba628a2e527e75c675c448c52eb05cc1f1f8709102", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\vnzuuijun.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\1fc6VHDHWaiUXR.m4a", "hashes": [ { "md5_hash": "6357bc54149cba544428784c0433f230", "sha1_hash": "bcd5d2cae4b888848a90ca8a63b37c4c2050c095", "sha256_hash": "abdb19f2f52b16492433c58b4f3f92079aaeac3298aed2feadeaa188e07db67b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\1fc6vhdhwaiuxr.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\D0I5ilhq2CC66S_eALG.m4a", "hashes": [ { "md5_hash": "58feeb6c0a8d6b8c0ff50d78f28885e2", "sha1_hash": "9cbbc6031e6808017669df470bb7a2e63f519f5f", "sha256_hash": "608c971dfc4e0319f8e435d89976c085c51bbcfe137b7b7960a0fa7c2d5897b4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\d0i5ilhq2cc66s_ealg.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\esxI.mp3", "hashes": [ { "md5_hash": "733585550054dc6ed95b4ec83420b6f0", "sha1_hash": "aee3d0171814ba4e53f0868835b27937873dc417", "sha256_hash": "1343c6dcadfb0d04b39cf0260b68f5ab7b4dabbff0ee7c9fd5efd9b6c3932b40", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\esxi.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\Ew3rSNw.mp3", "hashes": [ { "md5_hash": "41e5deb048024ef38b94630c5223d365", "sha1_hash": "76cb14460a77226515cac081e58ba731df533f49", "sha256_hash": "2069c416c8c16ce33d9b02a204f4194825afec85e895221cf0cafe7e7e8655e7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\ew3rsnw.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\i42JoVPAE6Wr.m4a", "hashes": [ { "md5_hash": "0fb34c7d0f053d21d608b8ea277b28c9", "sha1_hash": "90d40ce6670dce890cd09d346d68589b5b03ea9c", "sha256_hash": "a6f18da0473a435fd9b31667fa1ebe8e5db1d75f7f44ce1b50a7c7bc9cfe11a0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\i42jovpae6wr.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\k4EN3jl_.m4a", "hashes": [ { "md5_hash": "fc490dee92d7ba28af2adb66db5aca54", "sha1_hash": "0d53566be4a391be7fd715af4f31941e4734803c", "sha256_hash": "d17ed4b8b9c6579694c17462c1f333a4e22b46a4295a3371e3574098cd62a4af", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\k4en3jl_.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\Oc7NraySLdll.mp3", "hashes": [ { "md5_hash": "5d845b1ddf14fd713ba167b947d98559", "sha1_hash": "50c9348cb4ef95a6400be8c1a87e9d15ee4c805e", "sha256_hash": "4fe8205178e31f39942f682e989f0b38661366393ee36e9dc259474709c46f13", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\oc7nraysldll.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\605WO0IG7rv 5Gkzsb.mp3", "hashes": [ { "md5_hash": "92d8cb8ebee0bb258d0ff45bba2bb6b7", "sha1_hash": "db1c51175b3e42a1fd0f2adecaf54c364c036438", "sha256_hash": "b6077ff7a2a3ba47b36a1db551aaa36cb0d2e47f679429bf0550b60bd3429903", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\605wo0ig7rv 5gkzsb.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\m1rlMk2aKfhDRFd.m4a", "hashes": [ { "md5_hash": "a04e323349b77ad51775718d94d07295", "sha1_hash": "5ced5c633cd764396f3a66ebb33d70580c85d05f", "sha256_hash": "3452a2c547fa86a8458aef3b7df4401e93e4881d2d4ac252d3a78997baacca2e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\m1rlmk2akfhdrfd.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\PGszj43skZY.wav", "hashes": [ { "md5_hash": "b00326eb8d130047caf56c0246925ae6", "sha1_hash": "9eb3ce342b9865c336423eb839a1ae6568e87c31", "sha256_hash": "6e315628f59f2919f8329c624e822f963db94a8c92a5316a6509b5922ec13ce0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\pgszj43skzy.wav", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\yx7Ef.m4a", "hashes": [ { "md5_hash": "8d82a8ffae788d669b9ddcb04b39e04b", "sha1_hash": "c24f5f84cf5b6027643abdb0b74cd3285f2c3507", "sha256_hash": "addfb6544509b015e79c673160ee3a6a393fe52ed68c442f13f37c7d811a1339", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\yx7ef.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\tcOtOe4F9FR69v\\lCE5UuOv6Td.m4a", "hashes": [ { "md5_hash": "21afe0d57dab129e4eeb2e0f8e9e09dc", "sha1_hash": "b2ae5640ce2ca2aa9d3cba017b0dba6fa76da4a1", "sha256_hash": "7b699621de7ead27680c2377132ad87d45f5d012aefddf3e1d5c8047f5bfa917", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\lce5uuov6td.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\tcOtOe4F9FR69v\\vapNw9ByKw_HbBp.mp3", "hashes": [ { "md5_hash": "aaafcd348ec71e590e2674469356ab02", "sha1_hash": "259d3d85b41f3dffbd7a4ce1fdc551d2e574bc05", "sha256_hash": "91469c74b9970b2e4165a35e9ffcaefd5436e46e62aae2f9cd28239595240a08", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\vapnw9bykw_hbbp.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\tcOtOe4F9FR69v\\X9TnF17Hn1X0_EkcrC.mp3", "hashes": [ { "md5_hash": "4b8778a5461ddfcf01ea1ffa74ea30da", "sha1_hash": "3e638590c658fe9271f7477afe57ac074206fc65", "sha256_hash": "16cbb794377ac9e0e71a9f831909d91f264fbd8422c7bcec1abbf2eaea76f31d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\x9tnf17hn1x0_ekcrc.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\TfEyYXaoPWeg\\JFdazS.mp3", "hashes": [ { "md5_hash": "bc1906627c022794f5083fa1e9d4e445", "sha1_hash": "ef5af09875614c367f09e0dc4e64ba5f42b108a5", "sha256_hash": "535dc7348f9508a832322bae74043c27fd59e5a4599414213f0b8a2cc3b8bcbe", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\tfeyyxaopweg\\jfdazs.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\TfEyYXaoPWeg\\Pm7OTm.m4a", "hashes": [ { "md5_hash": "0742e8a807ed2e32afa17686ec6dc692", "sha1_hash": "374f1e1b03d2823d1ff6ed9b88bc358e4fb4ffe1", "sha256_hash": "e9bb179e71217f4746c63941d9a67f59bbe38ce7de4a4915e5e85698f1713001", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\tfeyyxaopweg\\pm7otm.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\E 0yaVCuvr4xTgj0s.m4a", "hashes": [ { "md5_hash": "6f6e2ecf0db7360f0afa5728831559b0", "sha1_hash": "78712f3c9015a24e34501d4c8ae43ee5d8c8e0eb", "sha256_hash": "45c7f50ca9507476362466b3479653a594b24af40b6f24a50c80f8c6ba341e36", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\e 0yavcuvr4xtgj0s.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\i30GiOiXB.mp3", "hashes": [ { "md5_hash": "c9bb8b82d67c18188946bcede0643e96", "sha1_hash": "4f6d8b6496fa017b30da91e5458de9793087710a", "sha256_hash": "153ddd4d181120b7dd545a44dad7dd2c4be1cff9c5889dd29b13db6e55e12aff", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\i30gioixb.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\IkM7 z01-mol8Cw-v67.mp3", "hashes": [ { "md5_hash": "ab1d36c557cd637ebc23b477c76d6c1a", "sha1_hash": "86233756e704378370f81a345f646e9ff955ea88", "sha256_hash": "aac3772f64ce5e546a77ed492e4ac3ed20ffb62400871d1c062f40ed6d2c5f82", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\ikm7 z01-mol8cw-v67.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\mRwbv.wav", "hashes": [ { "md5_hash": "427a283595977e77ae73ff64ca7f54fb", "sha1_hash": "b201e0f59f05cdaae03c84ec51a47080c5e0084c", "sha256_hash": "3d30b015795eb0cfeb5d510679701fa0ba997a347999d9fc535f83e38d3914c6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\mrwbv.wav", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\PPQizB7psZmEP.m4a", "hashes": [ { "md5_hash": "3a3a2f0cf688051867da1a102a06bf4c", "sha1_hash": "e558e3eefb5a2fe5b3ba3aa19ed33f932b3fd77c", "sha256_hash": "8b24602303558287d88743d316d682a4638f2f25f6ba91ba7eba107f102b7675", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\ppqizb7pszmep.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\Vm4ENrsiQIGSP.m4a", "hashes": [ { "md5_hash": "0bae79acdbfa8768050dd71671578cd6", "sha1_hash": "e493c273c9500815c8a7cbe630507bc38e30b639", "sha256_hash": "b3aa9d9dfd8b5b072e3b35068e58a2853b4fa93d2c1797b6bc8567ab1344f63b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\vm4enrsiqigsp.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\9qYbL5jzyJkpK.mp3", "hashes": [ { "md5_hash": "36ec66301c50b899fb4f26e0d6e0096d", "sha1_hash": "307327956ec1124c4a945ad175779eb637d7bd58", "sha256_hash": "6c313dd4858f47d61d0a618aebf65e98c2a06d649ba347f282bce38cbc282f31", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\9qybl5jzyjkpk.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\BOyhfUb.m4a", "hashes": [ { "md5_hash": "fcc60f00f0c916574574f596403c98a2", "sha1_hash": "07666e5cb6475230aef594bb9c3993a3d0117471", "sha256_hash": "387ed2ea2731052e631ef943a0d609ad3b346a1865fe6a877131db0bc91ed1c3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\boyhfub.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\cM_EMR.mp3", "hashes": [ { "md5_hash": "da1f34ad32348d864a69f3f26fd74705", "sha1_hash": "cc5a7e3f8c17d2a7dacd3624d82b40ac2f894ac9", "sha256_hash": "f145082df5097586bb5dd25e14a361d621d77bd14c4e174c7e5bb8c99aa39f8e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\cm_emr.mp3", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\mZVj-71FZcsC6I.m4a", "hashes": [ { "md5_hash": "f68b9e595fa1d2cfe074d3329b315ecd", "sha1_hash": "04de33073d4f6bd653be579c0d3a019b28d3296d", "sha256_hash": "3bf2e46f349980e193421664cf4d4accfe28c49e48ef596653ef89fc868b9da6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\mzvj-71fzcsc6i.m4a", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\sJWeRqq.wav", "hashes": [ { "md5_hash": "14d4489a821158afbfa5116dc33aae69", "sha1_hash": "7349f59264588f812d16dc0e2397b085c93f9325", "sha256_hash": "dfda495f4b70c219bee2b8b857e1c9e64e45908b33cc5fb6d709119151b986c1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\sjwerqq.wav", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\Tnvqh.wav", "hashes": [ { "md5_hash": "c63fb19280568181cd7e597a7a843798", "sha1_hash": "9ee6383f3e92cd745049320943b92e561e6b8d7a", "sha256_hash": "cae05315fcc1cdc50661b05daff39e3747ab024a6781abf2243405faf1a100aa", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\tnvqh.wav", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Links\\desktop.ini", "hashes": [ { "md5_hash": "2dd61f65d7d549f0564ae374b7bdc10d", "sha1_hash": "a7d6c597f67bedbce0b7d4843a274574e9f14ebe", "sha256_hash": "4a5b08ec17f9054b0cbb823f51431fc0ee45bcd530e1ede13945052efce215af", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Links\\Desktop.lnk", "hashes": [ { "md5_hash": "3effda9243388de22d1e73b186f14b2f", "sha1_hash": "78a35bb209ef9c18c5ece7ab4a5ad5781af10778", "sha256_hash": "7bec962c747e54009967b6bd6455e40f6829ffa9a22ceccce2ba579de2653e83", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\desktop.lnk", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Links\\Downloads.lnk", "hashes": [ { "md5_hash": "e46c1d25aa5c77c12544f777a3ad0719", "sha1_hash": "4ad79b7925cafafd4a800e09153f86bedbfbe8a4", "sha256_hash": "453a1c16eb3ae9f01e75204f4b3083732bd08300dc300d82c639ab28d2489c9a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\downloads.lnk", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Links\\OneDrive.lnk", "hashes": [ { "md5_hash": "ac1a60a4a24598311023a14e20d6bbc2", "sha1_hash": "16c74278447505ba6d7f7015a7eb983f813f4c9a", "sha256_hash": "a19711d62c877ad3ad615a4fb309515593f5bb480949debdf070a8dd1158a4b2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\onedrive.lnk", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Bing.url", "hashes": [ { "md5_hash": "c502ca9fdbec3f60dc8b4a0f8c82f0c3", "sha1_hash": "407b56722ef60f05c5edd7297278b223320f836e", "sha256_hash": "e3b8f17d1280c97b6e041d95854da3772509c5a9883d7a9f1bcf3acc8bb279c9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\bing.url", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Favorites\\desktop.ini", "hashes": [ { "md5_hash": "8e72f402d6f32a2eb8b40ef2bf09d134", "sha1_hash": "4997f213a0a8f74565d3d4a6411ee74ed5d370d5", "sha256_hash": "4f7b953408cc9936a382ff90102cbc50db2625cab0d8d017a81caa4b8132ecb5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\desktop.ini", "hashes": [ { "md5_hash": "e4dd0769eed2ff53c7a6d53383848aec", "sha1_hash": "ab6991ca91766ffa6a1c1c85d373eb2ba58b687c", "sha256_hash": "72a735d2fd20e5eb2909a8a433c0e3155452df4ea83b7c9dc43775144053c7b5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\links\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", "hashes": [ { "md5_hash": "d799fa9f1655f95dc9be3bd1830e630c", "sha1_hash": "a2efedfc9abdf934a0703583b1e602843e2ad95d", "sha256_hash": "a997604d3eba8e39c9f26b46448adcf9ca5ec53fcafb6328a733acaa3f069bf3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\chromesetup.exe", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", "hashes": [ { "md5_hash": "a366561c12c6f69711d3bb85e052fa7d", "sha1_hash": "c70b3c04a93e561b4cf463ac44d10923da75566f", "sha256_hash": "b1422698d4c21483ab1bd86344784727cad570b0b0b1eeaef1f221496e685910", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\jre-8u131-windows-x64.exe", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\5lFe4Lx.pptx", "hashes": [ { "md5_hash": "8ae6ba7e2cef64e1b83d905ef8a359d1", "sha1_hash": "3e0290cf998e9438a8fdc1d728853baf249855d5", "sha256_hash": "3319a6208bce5f2ffb77ced09c10b7f946b6ca496ebc1f1ca383d1da45309173", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\5lfe4lx.pptx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\atcbUa--7pS9_Ex5YF.xlsx", "hashes": [ { "md5_hash": "bb2b28d3d9425e23ace84a09fac7df48", "sha1_hash": "fe0682c1a4d8d9f3a4e42ba6b9cbc3d8fc5e3d81", "sha256_hash": "128d71c93597a29a31d5c6e0b34302de049a6b8946013e5a8eaf11dc0ebd6159", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\atcbua--7ps9_ex5yf.xlsx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\blBTLlE6nvl7Pn1.ots", "hashes": [ { "md5_hash": "e0ca48aa6b416a728272cb8532669d77", "sha1_hash": "179cf3e5b3ff62e80bfa8e04da3cbbfb36008987", "sha256_hash": "a205e4456ed8fc355a9c921561d0ba86572f7b2a97b437f56d28bb09fdcc1cdd", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\blbtlle6nvl7pn1.ots", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", "hashes": [ { "md5_hash": "7132d3a594fda47d039273bbc40dbffd", "sha1_hash": "860a7d33a834d69fcc947226d561d6ca7c1440bb", "sha256_hash": "b9b2bd048b7ee2b23a488b39c36a49d1a453087428ae56f7f43624b1658624bc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\EM9gXmq2LKv8ZfRa.docx", "hashes": [ { "md5_hash": "d6c0aecc35c6752044fc0a3f358c4438", "sha1_hash": "9f7f60ae8a6b76f239c49538aa2861b54decd2e8", "sha256_hash": "629221550960a4923ccad59511006ceacc33207ff3ae1ad3a325b5b7491d1a7d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\em9gxmq2lkv8zfra.docx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\iHZCO2.pptx", "hashes": [ { "md5_hash": "38829e481348405ceb8c56ea6afafcbc", "sha1_hash": "39927f5aa90216eb773e0c6e75e302b758a972b8", "sha256_hash": "adaa6d74ea28423855e6e7692b6e3f8e017d8a8e927b9ac2a1267bf01db3f422", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ihzco2.pptx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\J0-1VW5m.xlsx", "hashes": [ { "md5_hash": "bb3004b11d168b4a36362ab8dac001e3", "sha1_hash": "875b442fdc757c1aa6aeb27a313e6fc39057745b", "sha256_hash": "928ba3e229fb49221ffc5776bef2dbeef69868e8e47cbdbd142a06ac1e622b66", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\j0-1vw5m.xlsx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\K3DCzA0ZGH0l2.pptx", "hashes": [ { "md5_hash": "bdd35099b5733ef0f88a0ef16d548022", "sha1_hash": "5adbfab896b3022888b98fc88fba17090f2f3711", "sha256_hash": "aa91542cbf44a112c3ca34b229643b425702ac2fd7e393f38673b258ee01b17c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\k3dcza0zgh0l2.pptx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\KFqf_.docx", "hashes": [ { "md5_hash": "f62e0d8e2121eba5a7eba2c4295d5119", "sha1_hash": "e05607a0e937a02d31306827ad5146115f0c08f1", "sha256_hash": "18395014b6110b19aa83fd46ebfcb68071f3b217135cce3a1369cb17e980845a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\kfqf_.docx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\lMdzhF4zVS-.pps", "hashes": [ { "md5_hash": "c313df2430b95bccf035b45e8b914d7c", "sha1_hash": "06a99fd7f41b10a48adeeab576bdb8f600b3f26c", "sha256_hash": "ab9a7e09e71451e51982810687069d152bc87cdf15a878a0f3e2bf715cd22491", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\lmdzhf4zvs-.pps", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\m_9eSbnarKHeuqXe.docx", "hashes": [ { "md5_hash": "271ee1a8f66413cc5cbdc13ee9a38eb3", "sha1_hash": "b0ac972721872d2bdad0d08c5c42987ad6c54d5e", "sha256_hash": "0007103666a7d2d5ad561fe7672a402e3057fdc335683721e9d41cc2c8f4d703", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\m_9esbnarkheuqxe.docx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\n3KedfT.pptx", "hashes": [ { "md5_hash": "4e89acc7705a2c247531cfb38cc959ad", "sha1_hash": "364294d210db5d175c90bccc29115097075c7810", "sha256_hash": "654f3b03bb659e77075ec644c0550db81dfe36b8c5b5dac184ac1aaff79b7468", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\n3kedft.pptx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\OeV eLnpiBhWXEtbc4x.doc", "hashes": [ { "md5_hash": "43a109cbad2a998a80bb3859c38d63e5", "sha1_hash": "20e6954a2f3b7b21ccdd95abfba6253d4962ca80", "sha256_hash": "97831cd49259321394e24360862bef0b4ed701f8f68bf17eaa16311fa28e0046", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\oev elnpibhwxetbc4x.doc", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\oX bq4vkxJPJqad.xlsx", "hashes": [ { "md5_hash": "2adb27e44099ee6d25e57e76a8a47620", "sha1_hash": "16b0110bfec3748471ff0a9af02bc1e3feaa945a", "sha256_hash": "7c8c94ea900cb780b1e86f4f4c98123563be7ab7fdcdf3ba44917a1cf7df82e0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ox bq4vkxjpjqad.xlsx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\t ZQSDpu2iUJxLE-.pptx", "hashes": [ { "md5_hash": "f4a581445f7aa9a08a908eb3435d3bc1", "sha1_hash": "2125df9acfb366e05b4eac0df7544885b45e2055", "sha256_hash": "3e65b92de3ec19e33ba27854b4d525590f0783787d100e075a46fd0fe903584c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\t zqsdpu2iujxle-.pptx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\T-K5SGwmJ3 mPB9Ky.pps", "hashes": [ { "md5_hash": "5ed82021669a29cfaff651ff2eb994b7", "sha1_hash": "7d84cd164ca658ec1ffa8e0076a05e0d90834840", "sha256_hash": "f399c4c10846ff3acee01c2f1245171d52644c60e3d36288fb23c194a4290c56", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\t-k5sgwmj3 mpb9ky.pps", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\UTm7Gxl.docx", "hashes": [ { "md5_hash": "c5f37bb31bf82d434c4f160447302c2f", "sha1_hash": "2f34d66c058d9695961bdff0b84bbe82f08a04d1", "sha256_hash": "73f5a5be792c8bc6482290898c5650bb8b919d016a0d77c1fb8825e6a179805f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\utm7gxl.docx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\UwnMvSU.xlsx", "hashes": [ { "md5_hash": "0aadbe0252995e204ad2923b0f16f804", "sha1_hash": "c13664a4c2005697da822c62e112cbdf606be53c", "sha256_hash": "c255a6b0b9b59d2ee5ba0049086a146cbb803feaa1ebb19c0da0c4d768d3e355", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\uwnmvsu.xlsx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\v5i14i.docx", "hashes": [ { "md5_hash": "3cde757e4ac9b478f2008278635e5fa0", "sha1_hash": "b3504351bcf95644560fb6e085fe6daec668d7af", "sha256_hash": "9e3dbf4855f172b589e18a4199a4453238f4ca2a24e57c2ea3259b8eb5c3dc43", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\v5i14i.docx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\VCAVi.xlsx", "hashes": [ { "md5_hash": "6238bb78be1339b9b84d1d7269bc154e", "sha1_hash": "801fdc717f4d616a34639ed2c53c6304313d39ce", "sha256_hash": "5f57480f45195ff6f9b47fe359af826bbf874a773dc501c9680dea69016e1f3a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\vcavi.xlsx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\xCi5Tni.rtf", "hashes": [ { "md5_hash": "0bde91f0221a2b4ad9a3b70bde3b8210", "sha1_hash": "4bfe1825d7b1d75e7cdc9806eabd5e4b392b72ac", "sha256_hash": "007070b5fc331849f1bd6e0a7db59103032bcd88b605469deaeb78da74cadc04", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\xci5tni.rtf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\ZyRASY.xlsx", "hashes": [ { "md5_hash": "fef54df67c6fdf75b7060d5f49e2b8d3", "sha1_hash": "e0a22e6515fff108263aec290c8f0c0eca772fdb", "sha256_hash": "29843e2e80655534d29fb410f4a68e457e872d90f7b0ecb57869cb4581a3b89a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\zyrasy.xlsx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\1oYB.pptx", "hashes": [ { "md5_hash": "c9a73b53db9df683fd0ccddd73677e5c", "sha1_hash": "da0d71891879f9d1119585929f6a3e70d89cf327", "sha256_hash": "989136495493a8503b90b7bcabc84485d3bf28223aa3cbb0d8b21a124af376c2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\1oyb.pptx", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\5Fs 9 UvPA.doc", "hashes": [ { "md5_hash": "80a43a0cd95e74917ab9b95c595aa51d", "sha1_hash": "f15fa83391c035ed7147af2d644933297b423dba", "sha256_hash": "898e7ae080088de473abc7489ae11cbd154c1ab65299c331e5053cd0bbbfeb06", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\5fs 9 uvpa.doc", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\L1EP-E2O7byfuic0.csv", "hashes": [ { "md5_hash": "eddf88a74f8c1e38e81b2d39d0fb7287", "sha1_hash": "768dd32ba36737944d5ace6bfb5af83707c56eab", "sha256_hash": "40898d186753f8d7e6023c96570a22e1444f1a124f762f4c07ca2aa64b928e99", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\l1ep-e2o7byfuic0.csv", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\qF 8oXk89NL1YrK6.rtf", "hashes": [ { "md5_hash": "05a2747411805d61007a585241022ba1", "sha1_hash": "585383376b2364edc3995107f438512f3884efca", "sha256_hash": "6c3129a81a26f0d276a764ed3c7fbaace8ce847eded077b8516803c60e66052f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\qf 8oxk89nl1yrk6.rtf", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\18WQhA51.odp", "hashes": [ { "md5_hash": "ed686da5f988824371258451d3ddb018", "sha1_hash": "00704182211c992a1248d141d56478cafa7132ff", "sha256_hash": "019368379f17cc4936c49d82ce42e559cd289d8c6510f3da1543e20244290801", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\18wqha51.odp", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\D91N0Zq.odp", "hashes": [ { "md5_hash": "c44fb790a903e179e9e7e99ab84bc1e8", "sha1_hash": "6b9c157cb058922272eb22c3c5602c1d94785b56", "sha256_hash": "aea9d1b73f8f83a8f2bb9c909c6033078ec0b5c189622f19df8d03ae341538e5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\d91n0zq.odp", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\sNyJwDMYDf6NcUAOQLTL.xls", "hashes": [ { "md5_hash": "b2f5778eaa82936b9880b13b6cc13da3", "sha1_hash": "8a6973f5df8e4150a945138e774d8d12fbfc681f", "sha256_hash": "c733222b99882a60e133f39aef7cbef6374e93533ad12ef791f6dc558db83185", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\snyjwdmydf6ncuaoqltl.xls", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\WRYiECXnl.ods", "hashes": [ { "md5_hash": "45eaac4bc88b05e200b38b08360ac8fa", "sha1_hash": "21907f66018c1e00fbdeae8dbbbe08e8312e1128", "sha256_hash": "7e32f2864e64a33eb337e4bca656e4b81d6115d7e3984cf1cf70a78cb007c786", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\wryiecxnl.ods", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\xCTUW.xlsx", "hashes": [ { "md5_hash": "a099b07894d23f259de01bcd81532ab3", "sha1_hash": "35aeab669ec14f35f86cc273f380a4b618822039", "sha256_hash": "a638b3b671899fc0c2a422c3f662045bdaaf1269138b1b16ffe4dad39a6eba8a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\xctuw.xlsx", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Xie6INIoLR04EDGFFG.odp", "hashes": [ { "md5_hash": "ce5622667042406ce58a90565531f08b", "sha1_hash": "72322e6a97eca15e148203c98b50e7d095a37f12", "sha256_hash": "60d63174500f7fab9f0922dc5f2a82091e05ee312f4d75e5aabffa5ad2640f80", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\xie6iniolr04edgffg.odp", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\kFMszdL4nvSI2cz.docx", "hashes": [ { "md5_hash": "5139f918139be5599211e4c712f07bdd", "sha1_hash": "2cce857577dcaa1d2fdae120468c3eb588ebd3c8", "sha256_hash": "5b4d1b02dae55d427fd7ecd2cb5df99d767fe36058c6b567e33994088a3ef535", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\kfmszdl4nvsi2cz.docx", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\wGY2YQxdKU.pdf", "hashes": [ { "md5_hash": "326f7cbebd98a3b18f99a43a7db7b05a", "sha1_hash": "4c3768d54fb47063f1c1755c70088160d0e244d9", "sha256_hash": "7f71b00cb45357d55d27f6d2b94aebfdfce3f35dee287a8adcddb17c5ffa02b8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\wgy2yqxdku.pdf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\wi8F0Q5O.xls", "hashes": [ { "md5_hash": "d5997333bcd42432169bfcaee29512f0", "sha1_hash": "9f4a43f439980be525e48c9fbff55fc7edabc093", "sha256_hash": "bb2fe0b0822c2002b2ce57819b375c0f52cd68d7979d002272f227af7ae8b6dd", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\wi8f0q5o.xls", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\X5ifFEMYR.odp", "hashes": [ { "md5_hash": "9de86a69a5cc92864320d842ac329aaf", "sha1_hash": "5b29d9da543911b9f24bd5d241b1d8c9a9bd80fa", "sha256_hash": "ef0c4f7b3790b7af48fb54d9c088e8ad78ffff7a37de5d6deb49ec19b589016a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\x5iffemyr.odp", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\Xy sr4g.pptx", "hashes": [ { "md5_hash": "128767fe14a9907085fd57f6c937cfc0", "sha1_hash": "1df958b17a5b9763fb698187cafec716ab9b1d79", "sha256_hash": "134129fe83705338601df589940d84ae9218a1a75fc2d0c578408ae9748acf64", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\xy sr4g.pptx", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\yB mn0zdV.pptx", "hashes": [ { "md5_hash": "b2749671c660f1646c5037ec51a8bf90", "sha1_hash": "92ca8270f596b9429482882370e3c4253fe257eb", "sha256_hash": "7e14be90109155ea24e755540485f426e893954710baf6285b5eef9e63d992aa", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\yb mn0zdv.pptx", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\5WalP3Bl2rWl-yo.xls", "hashes": [ { "md5_hash": "d53936a9eec3f561e3ebfa9c778c4334", "sha1_hash": "c1fb7eafa9413c5aa69d844b7892796f8dd0b842", "sha256_hash": "3bf122ad6abeb26c19b9333ce3411ba51ef96d24d141e8128a338de4056f0377", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\5walp3bl2rwl-yo.xls", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\oIDz6LcGNvXGF5.csv", "hashes": [ { "md5_hash": "955e310b305a7e8202364c651d7e75b8", "sha1_hash": "40ba7d618b16398d69675848db8f3c9e374096d8", "sha256_hash": "e2a8916d0118c0fd8d54cedd715ab3af840515aad7a60473574cde18de86d475", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\oidz6lcgnvxgf5.csv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\oPt7hCN-3pA.xls", "hashes": [ { "md5_hash": "3e51be8ba7c141dd85be275ce5cccbc3", "sha1_hash": "1a6c72464834014a881501cd2dbc1f20e346a240", "sha256_hash": "13ffcb9e9f4301353a8f50af6bf4af1778c1a07562de78044a4cc394802c10e5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\opt7hcn-3pa.xls", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\PsMh09Ma0h6Sf.ots", "hashes": [ { "md5_hash": "aeb0d0c152fd93185711103144ab979e", "sha1_hash": "4d59939d7abe3f0b9accde8a972a1dd8f7f9aa0e", "sha256_hash": "8a2ecaea0995acdefa73abf55121aa89cd6fde12362cda4928e57169714ec8fe", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\psmh09ma0h6sf.ots", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\st0nFHr7kLd7u.doc", "hashes": [ { "md5_hash": "41d2932154f84eaf3cab87bf7a31cfcb", "sha1_hash": "f232156e9c35549d716910003fb608ba57e44ed2", "sha256_hash": "ccb1380350d1cf11b606f4fad048837386749aec598121b9710c4c3b2840568f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\st0nfhr7kld7u.doc", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\Ud56yevTC_MGVYoy1e.pptx", "hashes": [ { "md5_hash": "f32acbff1d55d75ff859ac340b6514be", "sha1_hash": "62a2d45b559f9b7a60926a8a99f5633e12c48081", "sha256_hash": "a5cac3c6ff0c64690a3b2239090494e30083a5b42f838f22f8390f38e6727e2b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\ud56yevtc_mgvyoy1e.pptx", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\VATb.csv", "hashes": [ { "md5_hash": "55c6a2205364cf393b393ce3fe80297c", "sha1_hash": "6d0056a644b354efae9424f01dab3fa33355f9ab", "sha256_hash": "1e53ab22d9ffb9afb5d3fc4935107c830caf2129bd7141be820c982e2e09ad8d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\vatb.csv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\yfDWeHYmEqVC.rtf", "hashes": [ { "md5_hash": "e4ca725480de99538747656fb243f6a0", "sha1_hash": "40d49f0e6ae4a03c3e8f31d5505cf786932996a8", "sha256_hash": "68e7cd45719d00a84ec4845337ab3f9fcfcec5386664c0d2426d907061bb53ca", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\yfdwehymeqvc.rtf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\WcaMW\\3qzJcOg3A.ods", "hashes": [ { "md5_hash": "ed3f754e5eca0ffa477f9b6e2ed592f9", "sha1_hash": "54c390f584ef73b4f678bee834c8ccea0bb1dbea", "sha256_hash": "799f2ab2e477efd4b00f4a8c932f2f3d7ef50c86ed5a5f7a5750f3c5ad9d1b2c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\wcamw\\3qzjcog3a.ods", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\WcaMW\\hfvups2InA_-BDQV8.rtf", "hashes": [ { "md5_hash": "c0ccae55766c814555f970daad435d74", "sha1_hash": "2510608c7e28d38e78465b8c4a48d886b2ae3482", "sha256_hash": "e2ba19b9bb407881b43899599adb1368bae5d8f7f748fc95c14196731a0bde1d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\wcamw\\hfvups2ina_-bdqv8.rtf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", "hashes": [ { "md5_hash": "1e22fc77e5bc9612f67bf185dfc04a15", "sha1_hash": "5790d282e5fd089b445970b5715e31f15667ad03", "sha256_hash": "05179a8e28d115d9421190660a0216a83e68ea9f1c07cade8af59e39d4194a65", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", "hashes": [ { "md5_hash": "9aa8a9f23804a3ec80fa871475dbfbdb", "sha1_hash": "7f9ead291dd9cb8ee524c82c4e30c3ae15d829b7", "sha256_hash": "77b4c0d5077e25a7a3704e7f90b30af7bc246962689b4730457875e3ddcd0973", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", "hashes": [ { "md5_hash": "a41e1e20c8bde5fea292e8b65d41986f", "sha1_hash": "d7617d18bc4c5dfc5e3aa2e8d8261bbe0d756134", "sha256_hash": "5c7795ed04090e95cd8e455955db8738e4a2124bbc17544de863e0899051698d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", "hashes": [ { "md5_hash": "b7ba30f52e6052a678f9b39e7f965d17", "sha1_hash": "f8efb0bfbdbc55f85ac8c41a76888c1ffcb833c7", "sha256_hash": "4fb0d86f57dc9ce54ad774b2f8d42292f226f3af462a56b2a8ad6bb0dd670c53", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\desktop.ini", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", "hashes": [ { "md5_hash": "41c4d389a921cbb64521e10a5078c10c", "sha1_hash": "5cfba21a4bc52a1fc56b8ce92cd554861da3aaa1", "sha256_hash": "1a8c01876d88f34dbbe6d6594057c12893ef188f4cc1066f17876d3096639495", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\2xnCn\\GRkI.docx", "hashes": [ { "md5_hash": "1b0174959cdf1c95e7302f7f642aab37", "sha1_hash": "8326e7835c750b9f5db47e5d2a22f2b050e8a85b", "sha256_hash": "62aae11d86e50f8dbcaf9093247519aa18272dafdadefc36b8d3d505bf7e27d8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\grki.docx", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\2xnCn\\Kt33N_.ppt", "hashes": [ { "md5_hash": "85052940c01ef0d3c9c27f50d59a6baa", "sha1_hash": "443ce008650116e5f5b2e46405f9012112a7d464", "sha256_hash": "0d9ccdc0d2312b2fdd4acd1ab28f1d539aa6a799eb470984fb4c494d62fae004", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\kt33n_.ppt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\2xnCn\\uCq2JjZ35.xlsx", "hashes": [ { "md5_hash": "e0ad9b054b207ded2770a5b538452a0f", "sha1_hash": "bb17fdf10902f89c0e50402243b81c5725f9f202", "sha256_hash": "67199ddf4dbd100f8a710b2ca6a95eb7fbca95e9bdbc37a8431bf3e34d71b3d3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\ucq2jjz35.xlsx", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\2xnCn\\vVBl5CzqCzhTO.pptx", "hashes": [ { "md5_hash": "4eaad822e259b13761f077f604889d85", "sha1_hash": "1c0d13aac0f75b3bb076003af17e3d0d056bf25c", "sha256_hash": "d2a6a09d8be9a40d4256ef12a37ffe01f5979ab403d6464058a38a4388e371be", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\vvbl5czqczhto.pptx", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\1IlkJYRGg.ots", "hashes": [ { "md5_hash": "1696b50b454109c22f7c62c0714fbb92", "sha1_hash": "7152dfea0d70b3bc0aae98d0117878b3bfb4e189", "sha256_hash": "a762cb70e2691cca2658d174de64f6c2188bc17fe2a3fe7e1e989606aa5b17d5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\1ilkjyrgg.ots", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\23i5acjUYsPml.m4a", "hashes": [ { "md5_hash": "1049d6cfe5fcc37f7e557a255cec377d", "sha1_hash": "3625354724d3a06c839371ed15d5f8af54be7078", "sha256_hash": "790f1d58144a7dc5b4d191b921fcee9bc029dfaf79a368f6fcd7e3950982414d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\23i5acjuyspml.m4a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\34vihcjptwSY126cU6r.jpg", "hashes": [ { "md5_hash": "1a8c1766f2707c2f0973a80b3531f419", "sha1_hash": "39d8ad9b912c520658a91b194d6ce7ccaf7b937c", "sha256_hash": "05b299956ca9ed1ccad20469151cde9c1e811cdaef4d01ac71f8e0fc830e885a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\34vihcjptwsy126cu6r.jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5AYMmPlf.mp3", "hashes": [ { "md5_hash": "0aadc6941fef5e387cee1db92622d22e", "sha1_hash": "8422a1e0d87c962ea7138611920d7218bb68e29a", "sha256_hash": "9e6a6d4489b2489ff45ac6c29993382955159ed43c4ebf69f5fc00632376c183", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\5aymmplf.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7UeLr6 ahNxhpqMpU.flv", "hashes": [ { "md5_hash": "28ba4169da6d69a97930ba2edd8c6ef2", "sha1_hash": "010b5042c14e40944d38329a95fe24793bbe3989", "sha256_hash": "29fc657349085667f690d1aa6b761fe060ff1765abc96f66f9e6e65bab12b1e1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\7uelr6 ahnxhpqmpu.flv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\9j9hSV0AGjQ5P.mp4", "hashes": [ { "md5_hash": "0a88f39f142d19070c62bb3853c9fb88", "sha1_hash": "18dec2ee645b8558ff53f9a56a80d60b06d62fb2", "sha256_hash": "dd478094357324673e879840eb21a008ee218b69107c7c097d4621f4a96e5506", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\9j9hsv0agjq5p.mp4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aF0cJNiJiaE7zPu.swf", "hashes": [ { "md5_hash": "263e21ad09c330f8518cc491c7000f95", "sha1_hash": "bbcf9e81f3a1ab303224edd160f1fe05682cbeb5", "sha256_hash": "d7426fd57e5734570dd1a6b424bdb25827ac84f0fe8376784a6ff877a90a13d6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\af0cjnijiae7zpu.swf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\BwjEJ4q.gif", "hashes": [ { "md5_hash": "7413754f9c6e16e9dfc044f6de3b6823", "sha1_hash": "5edba77834febc437f81c74a3d27ad01633153be", "sha256_hash": "ffc5b02b3b793cb97fa3ed455c0faf5829231dc62b3a284055ad53544ee19868", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\bwjej4q.gif", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\cfrs5lie-afnL_qf.jpg", "hashes": [ { "md5_hash": "bb7a682d9063e54fbc7c03db7a99ff4f", "sha1_hash": "0b8d12fcd3c43aed1253a41eb901d2ae794be112", "sha256_hash": "c4805b3ab365557436f3cafafe18685652e5849cd7f4f18a145f84b42d894087", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cfrs5lie-afnl_qf.jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\cp_i6VwPEAGUcDb9VyN0.pdf", "hashes": [ { "md5_hash": "5cfbabe8dde1f2fd154410b802dd7b34", "sha1_hash": "ced769de411494a779b2b2343cd9f4b79680e3a9", "sha256_hash": "93999ffd16aafbc136d3e430b5bec7fc0a67f521b0bd5ae4ef00e6317d28f56e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cp_i6vwpeagucdb9vyn0.pdf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\cR1v23Mrj a0X.m4a", "hashes": [ { "md5_hash": "353e22f480804d868ba20aa5ac199d8b", "sha1_hash": "06e8d8c2ffba635b70c747c95c456e3cadf25f62", "sha256_hash": "667d72304a80383477cc66d3cd1415043e689a10be09a88a652e2ab78b14f6c2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cr1v23mrj a0x.m4a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", "hashes": [ { "md5_hash": "1303831f18dffd4cf7f31ee7c7682dc9", "sha1_hash": "af7733df345ddf40bce6ff8799b0ebbfd06c2e62", "sha256_hash": "032970cd060cdf8c701de88534b813f7b69277ce8ae5be1f12f8363b387bcfe7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Dm CHu2si-01iRgc2.pps", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\dm chu2si-01irgc2.pps", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\eWhS_.mp3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\ewhs_.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MSC000000981631.vbs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\msc000000981631.vbs", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\O1hl.flv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\o1hl.flv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OfmyPUTg.wav", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\ofmyputg.wav", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\phaPdn7U89EhKuLZIB.gif", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\phapdn7u89ehkulzib.gif", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Qgj3gqt4NmSeH.avi", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\qgj3gqt4nmseh.avi", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\QPcuvsBPfyJdsjj0R.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\qpcuvsbpfyjdsjj0r.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\quymqFwIVsq34Nza18mw.mp3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\quymqfwivsq34nza18mw.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rqqQHXhU2jy2mu2PyuI.jpg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\rqqqhxhu2jy2mu2pyui.jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\sf42hT3t.flv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\sf42ht3t.flv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\W9fVdr5L65XR8o.avi", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\w9fvdr5l65xr8o.avi", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xCEXvXhj0VQdjnT3.jpg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\xcexvxhj0vqdjnt3.jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z8 bc8_xQU.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\z8 bc8_xqu.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Z82HPIHYz D.flv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\z82hpihyz d.flv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZyLZN4wKBOnt edaUa.avi", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\zylzn4wkbont edaua.avi", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Zbtp57yuqYSnW07xS\\IprKUQN5V.flv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\zbtp57yuqysnw07xs\\iprkuqn5v.flv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Zbtp57yuqYSnW07xS\\JJwbkuO44n.gif", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\zbtp57yuqysnw07xs\\jjwbkuo44n.gif", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Zbtp57yuqYSnW07xS\\vBNDk.ppt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\zbtp57yuqysnw07xs\\vbndk.ppt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\9jTu8T4KEHg5MRd.xls", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\9jtu8t4kehg5mrd.xls", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\QLOJTsq6N0t9Kt4SxCxw.jpg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\qlojtsq6n0t9kt4sxcxw.jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Z-Bho7uk1tOcQIpb.swf", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\z-bho7uk1tocqipb.swf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\zbnK-TfEBdN8Xe.m4a", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\zbnk-tfebdn8xe.m4a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\1b 3uKDjMA.rtf", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\1b 3ukdjma.rtf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\cvvEUY6.flv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\cvveuy6.flv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\eu1jcB_.gif", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\eu1jcb_.gif", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\LRm18Lj3x1fX2IJ.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\lrm18lj3x1fx2ij.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\lsRwPHc.odp", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\lsrwphc.odp", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\aclviho asldjfl.contact", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\asdlfk poopvy.contact", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\chucu jadnvk.contact", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\desktop.ini", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\desktop.ini", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\lulcit amkdfe.contact", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\sikvnb huvuib.contact", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2A7x9EPcCAgl.ppt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2a7x9epccagl.ppt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\AmZ3.jpg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\amz3.jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dgkF.bmp", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dgkf.bmp", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\e4fZOADVmOZQm.mkv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\e4fzoadvmozqm.mkv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\etLaCzOa2X6.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\etlaczoa2x6.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\F5nHzYdQA07MgBbF.wav", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\f5nhzydqa07mgbbf.wav", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\gD34Cv9-IHgCunUMAE.wav", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\gd34cv9-ihgcunumae.wav", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\H0OF8ATjoMI2aUXO4m.mp4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\h0of8atjomi2auxo4m.mp4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\h0_3DUVl2w52PWKJiRk.ods", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\h0_3duvl2w52pwkjirk.ods", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\hxh5o9rz4Edu-fPev.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hxh5o9rz4edu-fpev.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IEa0O.bmp", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\iea0o.bmp", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\K0j6F-xlIeLiy.mp4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\k0j6f-xlieliy.mp4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\KvZ2MG9pJ.avi", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\kvz2mg9pj.avi", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LnELOxkuzwomT.mp3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lneloxkuzwomt.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\oJq0bw.mp4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ojq0bw.mp4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\OuO0Z.pps", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ouo0z.pps", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r8UCd.flv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\r8ucd.flv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rF9cz5H_X40G5jLH.mkv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rf9cz5h_x40g5jlh.mkv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SpDa.csv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\spda.csv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SVMzi08.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\svmzi08.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\t7rM-lmeZ.m4a", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\t7rm-lmez.m4a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UjkY.xlsx", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ujky.xlsx", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\w7lhDIvk.mp3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\w7lhdivk.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\W9JHrRgo LbXIOiPY7w.doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\w9jhrrgo lbxioipy7w.doc", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WL sWzcfAqsxCr.gif", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\wl swzcfaqsxcr.gif", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XFr9Wzy.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xfr9wzy.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XjJL2fLOy8LCZl1A4u8.wav", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xjjl2floy8lczl1a4u8.wav", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xrIFO.mkv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xrifo.mkv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yt58.mkv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yt58.mkv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ZEXa.wav", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\zexa.wav", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\skype\\roottools\\roottools.conf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles.ini", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\addons.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-addons.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-gfx.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-plugins.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist.xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cert8.db", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\compatibility.ini", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\containers.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\content-prefs.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cookies.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.ini", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\formhistory.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\key3.db", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\kinto.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\mimeTypes.rdf", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\mimetypes.rdf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\permissions.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\places.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\pluginreg.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\prefs.js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\revocations.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\search.json.mozlz4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\search.json.mozlz4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\secmod.db", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessioncheckpoints.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore.js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sitesecurityservicestate.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\times.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\times.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\webappsstore.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\webappsstore.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\xulstore.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\xulstore.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore-backups\\previous.js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\license.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\session-state.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\state.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\store.json.mozlz4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\crashes\\store.json.mozlz4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kl0o5i+exwq3txuldkmf9w==.jsonlz4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170518000419", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20170518000419", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\addressbook.acrodata", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globdata", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globsettings", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\adobe\\acrobat\\dc\\readermessages", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb.chk", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB00004.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb00004.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDBres00001.jrs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edbres00001.jrs", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDBres00002.jrs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edbres00002.jrs", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edbtmp.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\0g-mX7JTJe-Sj10.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\0g-mx7jtje-sj10.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\2U0LE_l1ov.wav", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\2u0le_l1ov.wav", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\3--oMmPwZ.avi", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\3--ommpwz.avi", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\3vZH2yjtYsKfc7y.bmp", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\3vzh2yjtyskfc7y.bmp", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\3Zhtv.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\3zhtv.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\47QMQ.jpg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\47qmq.jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\65Orwx5ceqv.mp3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\65orwx5ceqv.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\6fNW.csv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\6fnw.csv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\8gXW1Z6dvIk.bmp", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\8gxw1z6dvik.bmp", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\9GKFDLC9zdG9VdStxiB.gif", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\9gkfdlc9zdg9vdstxib.gif", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\ArmUI.ini", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\armui.ini", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\FW6lt2NDjZH.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\fw6lt2ndjzh.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\F_4Tu8ppFN_dR.m4a", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\f_4tu8ppfn_dr.m4a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\g7wBDP8D.mp3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\g7wbdp8d.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\iDZnhlbh_ G-e45.mp4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\idznhlbh_ g-e45.mp4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\klAR_8_n.swf", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\klar_8_n.swf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\LHNIWSJ-20171110-1726.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\lhniwsj-20171110-1726.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\lUDWozZeb1O57be4N4p.avi", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\ludwozzeb1o57be4n4p.avi", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\NNRGrFwXihuC8WV.mp3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nnrgrfwxihuc8wv.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\oFv5oNAG.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\ofv5onag.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\rav5pCmmACXHU.mp3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\rav5pcmmacxhu.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\rVpdrW_orZM9.bmp", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\rvpdrw_orzm9.bmp", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\sU6SVcwb41LxR.mp3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\su6svcwb41lxr.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\VfH6K03Dt2b6cL.mp3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\vfh6k03dt2b6cl.mp3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\W8nb", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\w8nb", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\y-deNk8MyPH4JZrn4.pptx", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\y-denk8myph4jzrn4.pptx", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\yEvVo0n.csv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\yevvo0n.csv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\_TyC_.flv", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\_tyc_.flv", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\nsmA14E.tmp\\System.dll", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nsma14e.tmp\\system.dll", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{241d7c96-f8bf-4f85-b01f-e2b043341a4b}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{241d7c96-f8bf-4f85-b01f-e2b043341a4b}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{33C56305-BA7B-48E0-9784-2D05E3F5D27E}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{33c56305-ba7b-48e0-9784-2d05e3f5d27e}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{728047C0-00D2-4FDB-A069-06338B92E93B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{728047c0-00d2-4fdb-a069-06338b92e93b}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{7940ACF8-60BA-4213-A7C3-F3B400EE266D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{7940acf8-60ba-4213-a7c3-f3b400ee266d}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{A88F43D0-B9C8-42F2-B9F3-90902FC0B22B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{a88f43d0-b9c8-42f2-b9f3-90902fc0b22b}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{E2E2F6CF-9D1A-4004-8999-8AB81010B5AC}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{e2e2f6cf-9d1a-4004-8999-8ab81010b5ac}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Proxy_Automatic_Config_Group.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_proxy_automatic_config_group.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsChangeAccountPicture.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingschangeaccountpicture.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupAppSizesList.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupappsizeslist.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupAutoplayDefaults.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupautoplaydefaults.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupDataSenseMainPageOverview.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupdatasensemainpageoverview.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupDataSenseMainPageSettings.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupdatasensemainpagesettings.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessFilterKeys.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessfilterkeys.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessNarrator.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessnarrator.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessOSK.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessosk.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessOther.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessother.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessStickyKeys.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessstickykeys.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessToggleKeys.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccesstogglekeys.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupFamilyUsers.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupfamilyusers.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupInputMouse.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupinputmouse.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupLockScreenPreview.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouplockscreenpreview.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupMapsUpdates.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupmapsupdates.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupNotificationsAppList.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupnotificationsapplist.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemDeviceEncryption.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemdeviceencryption.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemSupportInfo.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemsupportinfo.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemWindowsInfo.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemwindowsinfo.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPen.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppen.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPersonalizeColorChoose.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppersonalizecolorchoose.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPicturePassword.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppicturepassword.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepDisplayOff.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepdisplayoff.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepDisplayOffAoAc.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepdisplayoffaoac.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepSleep.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepsleep.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPrivacyLocationHistory.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupprivacylocationhistory.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupRegionDateTimeFormats.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupregiondatetimeformats.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupSpeechMicrophone.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupspeechmicrophone.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupVirtualDesktops.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupvirtualdesktops.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupYourAccount.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupyouraccount.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsManage.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountsmanage.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsPicture.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountspicture.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsSync.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountssync.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsUsers.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountsusers.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageActivate.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageactivate.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaults.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaults.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaultsFileExtensionView.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaultsfileextensionview.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaultsProtocolView.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaultsprotocolview.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsNotifications.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsnotifications.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageBackground.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagebackground.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageBatterySaver.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagebatterysaver.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageColors.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagecolors.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDataSenseOverview.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedatasenseoverview.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDevicesPen.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedevicespen.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDevicesPrinters.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedevicesprinters.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessClosedCaptioning.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessclosedcaptioning.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessHighContrast.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccesshighcontrast.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessKeyboard.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccesskeyboard.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMagnifier.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmagnifier.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMoreOptions.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmoreoptions.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMouse.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmouse.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessNarrator.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessnarrator.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageLockScreen-2.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagelockscreen-2.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageLockScreen.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagelockscreen.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageMaps.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagemaps.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageMultiTasking.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagemultitasking.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkAirplaneMode.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkairplanemode.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkDialup.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkdialup.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkDirectAccess.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkdirectaccess.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkEthernet.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkethernet.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkMobileBroadband.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkmobilebroadband.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkMobileHotspot.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkmobilehotspot.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkProxy.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkproxy.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkVPN.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkvpn.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkWiFi.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkwifi.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkWorkplace.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkworkplace.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemAutoPlay.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemautoplay.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemBluetooth.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystembluetooth.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDevices.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdevices.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDeviceSettings.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdevicesettings.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDisplay.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdisplay.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemInfo.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsysteminfo.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemShellMode.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemshellmode.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyAccountInfo.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacyaccountinfo.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCalendar.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycalendar.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyContacts.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycontacts.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCustomPeripherals.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycustomperipherals.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyGeneral.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacygeneral.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyLocation.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacylocation.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMessaging.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymessaging.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMicrophone.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymicrophone.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMotionData.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymotiondata.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyPersonalization.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacypersonalization.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyRadios.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacyradios.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacySIUFSettings.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacysiufsettings.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyWebcam.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacywebcam.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreDeveloperOptions.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoredeveloperoptions.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreMusUpdate.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoremusupdate.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreOneBackup.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoreonebackup.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreRestore.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestorerestore.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageScreenPowerAndSleep.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagescreenpowerandsleep.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageSpeech.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagespeech.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStart.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestart.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStorageSenseSaveLocations.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestoragesensesavelocations.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStorageSenseStorageOverview.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestoragesensestorageoverview.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageThemes.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagethemes.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionDateTime.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregiondatetime.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionLanguage.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregionlanguage.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionSpelling.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregionspelling.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageWindowsDefender.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagewindowsdefender.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageWindowsServerDefender.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagewindowsserverdefender.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Settings_DeveloperModeGroup.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settings_developermodegroup.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Settings_DeviceDiscoveryGroup.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settings_devicediscoverygroup.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_CursorThickness.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_cursorthickness.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsAnimationsEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_isanimationsenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsMouseKeysEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_ismousekeysenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsOverlappedContentEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_isoverlappedcontentenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsAutoStartEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isautostartenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsFollowInsertPointEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isfollowinsertpointenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsFollowKeyFocusEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isfollowkeyfocusenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsInversionColorEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isinversioncolorenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_MouseCursorColor.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_mousecursorcolor.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_MouseCursorSize.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_mousecursorsize.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsAutoStartEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isautostartenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsDuckAudioEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isduckaudioenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEchoCharacterEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isechocharacterenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEchoWordEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isechowordenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsFastKeyEntryEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isfastkeyentryenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsFollowInsertionEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isfollowinsertionenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsHighlightCursorEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_ishighlightcursorenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsPlayAudioCuesEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isplayaudiocuesenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsReadHintsEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isreadhintsenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechPitch.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechpitch.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechSpeed.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechspeed.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechVoices.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechvoices.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_NotificationDuration.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_notificationduration.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Autoplay_IsEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_autoplay_isenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_OverrideControl.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_overridecontrol.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink-2.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_settingslink-2.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_settingslink.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink-2.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_usagedetailslink-2.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_usagedetailslink.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DataSense_ConfigureSetLimitButton.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datasense_configuresetlimitbutton.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_CountryRegion.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_countryregion.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsAutomaticDSTAdjustEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_isautomaticdstadjustenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsTimeSetAutomaticallyEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_istimesetautomaticallyenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_Set.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_set.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_SetFormats.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_setformats.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_TimezoneInfo.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_timezoneinfo.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Audio.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_audio.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Browser.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_browser.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Calendar.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_calendar.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Email.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_email.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Map.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_map.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Photos.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_photos.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Video.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_video.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_EnablePixie.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_enablepixie.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_EnableRipple.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_enableripple.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_SetHandedness.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_sethandedness.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Device_Add.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_device_add.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_AdvancedSettings.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_advancedsettings.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_DPI_Override.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_dpi_override.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Duplicate.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_duplicate.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IdentifyDetectWireless.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_identifydetectwireless.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IsAutoBrightnessEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_isautobrightnessenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IsRotationLocked.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_isrotationlocked.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_MainMonitor.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_mainmonitor.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Monitors.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_monitors.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Orientation.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_orientation.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Mouse_SetButtonConfiguration.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_mouse_setbuttonconfiguration.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Mouse_SetScrollPage.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_mouse_setscrollpage.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_CursorSpeed.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_cursorspeed.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableEdgeGesture.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enableedgegesture.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableTouchPad.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enabletouchpad.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableVisualFeedback.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enablevisualfeedback.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableVisualFeedbackPM.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enablevisualfeedbackpm.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_FourFingerTapEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_fourfingertapenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_LeaveOnWithMouse.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_leaveonwithmouse.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_PanEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_panenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_RightClickZoneEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_rightclickzoneenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_SetActivationTimeout.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_setactivationtimeout.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_SetScrollDirection.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_setscrolldirection.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_TapAndDrag.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_tapanddrag.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_TapsEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_tapsenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_ThreeFingerSlideEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_threefingerslideenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_ThreeFingerTapEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_threefingertapenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_TwoFingerTapEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_twofingertapenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_ZoomEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_zoomenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsAutoCorrectionEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_isautocorrectionenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsAutoShiftEngageEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_isautoshiftengageenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsCompatibilityKeyboardEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_iscompatibilitykeyboardenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsDoubleTapSpaceEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_isdoubletapspaceenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsKeyAudioFeedbackEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_iskeyaudiofeedbackenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsPredictionSpaceInsertionEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_ispredictionspaceinsertionenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsShiftLockEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_isshiftlockenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsSpellcheckingEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_isspellcheckingenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsTextPredictionEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_istextpredictionenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Add_Profile.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_language_add_profile.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Installed_Profiles_Collection.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_language_installed_profiles_collection.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Personal_Data_Control.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_language_personal_data_control.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Web_Content_Control.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_language_web_content_control.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Maps_DeleteAll.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_maps_deleteall.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Maps_Download_Add_Package.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_maps_download_add_package.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_ResetYourPC.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_misc_resetyourpc.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_PreviewBuild.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_misc_rollbackyourpc_previewbuild.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_Windows7.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_misc_rollbackyourpc_windows7.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_Windows8.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_misc_rollbackyourpc_windows8.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_Windows8_1.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_misc_rollbackyourpc_windows8_1.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MultiTasking_AeroSnapEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_multitasking_aerosnapenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MultiTasking_SnapAssistEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_multitasking_snapassistenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MultiTasking_SnapFillEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_multitasking_snapfillenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MusUpdate_AdvancedSettingsLink.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_musupdate_advancedsettingslink.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MusUpdate_UpdateActionButton.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_musupdate_updateactionbutton.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_PinnedQuickActions.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_notifications_pinnedquickactions.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_SelectIconsToAppearOnTaskbar.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_notifications_selecticonstoappearontaskbar.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_ShowAppNotifications.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_notifications_showappnotifications.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_SoftLandingEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_notifications_softlandingenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_SystemIcons.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_notifications_systemicons.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_ActivateWindowsLicense.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_activatewindowslicense.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_GetPCName.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_getpcname.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_InstalledRamStatus.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_installedramstatus.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_JoinCloudDomain.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_joinclouddomain.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_JoinDomain.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_joindomain.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_LeaveOrganization.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_leaveorganization.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_PenAndTouchStatus.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_penandtouchstatus.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_ProcessorStatus.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_processorstatus.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_ProductIdStatus.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_productidstatus.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_RenamePC.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_renamepc.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_SystemTypeStatus.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_systemtypestatus.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Background_ChooseBackground.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_background_choosebackground.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Background_ChooseFit.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_background_choosefit.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Color_ColorPrevalence.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_color_colorprevalence.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Color_EnableTransparency.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_color_enabletransparency.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenAppsBadge.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_lockscreenappsbadge.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenAppsTile.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_lockscreenappstile.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenBackground.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_lockscreenbackground.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenChooseBackgroundType.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_lockscreenchoosebackgroundtype.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenSlideshowSource_CloudBrandName.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_lockscreenslideshowsource_cloudbrandname.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutAC.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_displayofftimeoutac.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutAC_AoAc.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_displayofftimeoutac_aoac.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutDC.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_displayofftimeoutdc.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutDC_AoAc.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_displayofftimeoutdc_aoac.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_SleepTimeoutAC.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_sleeptimeoutac.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_SleepTimeoutDC.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_sleeptimeoutdc.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Privacy_AdvertisingIdEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_privacy_advertisingidenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Privacy_EnableCollectionOfUrlsAppsUse.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_privacy_enablecollectionofurlsappsuse.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Privacy_OpenPrivacyStatementLink.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_privacy_openprivacystatementlink.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Proxy_AutomaticConfigScript.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_proxy_automaticconfigscript.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Proxy_AutomaticDetection.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_proxy_automaticdetection.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Proxy_ManualProxyAddress.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_proxy_manualproxyaddress.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Radio_DeviceList.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_radio_devicelist.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Radio_IsAirplaneModeEnabled.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_radio_isairplanemodeenabled.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_ModeChangeConfig.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_shellmode_modechangeconfig.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_Preference.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_shellmode_preference.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_TaskbarAppsVisibility.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_shellmode_taskbarappsvisibility.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_Toggle.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_shellmode_toggle.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Startup_AdvancedStartup.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_startup_advancedstartup.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_LinkToPlacesPage.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_linktoplacespage.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_ShowRecentlyAddedAppsGroup.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_showrecentlyaddedappsgroup.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_ShowSuggestedAppsGroup.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_showsuggestedappsgroup.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_Size.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_size.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_StoreMFUApps.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_storemfuapps.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_StoreRecentlyOpenedItems.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_storerecentlyopeneditems.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_StorageSense_AppSizesOptionalComponentsLink-2.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_storagesense_appsizesoptionalcomponentslink-2.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_StorageSense_AppSizesOptionalComponentsLink-3.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_storagesense_appsizesoptionalcomponentslink-3.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_StorageSense_AppSizesOptionalComponentsLink.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_storagesense_appsizesoptionalcomponentslink.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncAccessibility_Toggle.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_syncaccessibility_toggle.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncBrowserSettings_Toggle.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_syncbrowsersettings_toggle.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncCredentials_Toggle.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_synccredentials_toggle.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncLanguage_Toggle.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_synclanguage_toggle.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncMaster_Toggle.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_syncmaster_toggle.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncPersonalization_Toggle.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_syncpersonalization_toggle.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_Windows_Toggle.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_windows_toggle.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_AssignedAccess.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_assignedaccess.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_ChangePassword.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_changepassword.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_DelayLock.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_delaylock.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_EnrollmentFace.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_enrollmentface.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_EnrollmentFingerprint.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_enrollmentfingerprint.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_EnrollmentIris.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_enrollmentiris.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PicturePassword.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_picturepassword.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PINPassword.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_pinpassword.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_SingleSignOnAccountList.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_singlesignonaccountlist.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_AltTabFilter.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_virtualdesktops_alttabfilter.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_TaskbarFilter.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_virtualdesktops_taskbarfilter.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_CorpDeviceManagement.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_workplace_corpdevicemanagement.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_RelatedSettings.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_workplace_relatedsettings.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AddOrRemovePrograms.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\addorremoveprograms.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0042AE00-17CC-42EC-B5AD-B8F08A025D71}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0042ae00-17cc-42ec-b5ad-b8f08a025d71}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{01ACC6BC-9A3D-49c5-AC7D-0FB9E026C424}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{01acc6bc-9a3d-49c5-ac7d-0fb9e026c424}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{028DE9F5-65F3-4A06-A048-421056F3E421}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{028de9f5-65f3-4a06-a048-421056f3e421}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{030C20F0-E20B-417A-B7AD-CEC6EE955CD3}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{030c20f0-e20b-417a-b7ad-cec6ee955cd3}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{059ECE57-19D1-4112-B05C-86F8ED5DA6B0}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{059ece57-19d1-4112-b05c-86f8ed5da6b0}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06628900-13DD-4fc3-A18B-0E9CE7B663ED}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06628900-13dd-4fc3-a18b-0e9ce7b663ed}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06D12455-F35D-44D6-8E00-3F6A360CC030}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06d12455-f35d-44d6-8e00-3f6a360cc030}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06FF5AE9-8F7C-41AD-B71B-62137DE26715}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06ff5ae9-8f7c-41ad-b71b-62137de26715}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{082594D9-8481-43F0-AE8F-62EA920A4220}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{082594d9-8481-43f0-ae8f-62ea920a4220}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{083D5202-600A-4f38-981B-2D138FBDC4D1}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{083d5202-600a-4f38-981b-2d138fbdc4d1}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08D48377-1C06-416D-B382-61E8D5F6CD18}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{08d48377-1c06-416d-b382-61e8d5f6cd18}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08EB53B7-3384-473A-8D2C-6C0E71F3BF34}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{08eb53b7-3384-473a-8d2c-6c0e71f3bf34}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0CDC534D-A9FF-450D-91D8-96C341ED44AA}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0cdc534d-a9ff-450d-91d8-96c341ed44aa}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0DF721FA-F921-4416-A491-1924F212C705}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0df721fa-f921-4416-a491-1924f212c705}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0F1B68F6-B72D-4229-BC9C-A87F0B16B17B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0f1b68f6-b72d-4229-bc9c-a87f0b16b17b}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1011988D-12F9-446b-85FF-A1579CCD1678}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1011988d-12f9-446b-85ff-a1579ccd1678}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11135AE0-7372-4f85-8D1B-93D6EFBE5A99}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{11135ae0-7372-4f85-8d1b-93d6efbe5a99}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11E71674-7556-4E27-8D59-03B2FA846204}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{11e71674-7556-4e27-8d59-03b2fa846204}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{12BBBD91-8E16-4C3F-9715-16E5C8299244}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{12bbbd91-8e16-4c3f-9715-16e5c8299244}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{141D98AD-3E07-4C44-A578-4DCA078286A4}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{141d98ad-3e07-4c44-a578-4dca078286a4}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{14DEC75C-D6CE-44A9-8349-AD0F46EF96BE}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{14dec75c-d6ce-44a9-8349-ad0f46ef96be}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1515BA81-68EB-4143-A29F-51A40A65DAE6}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1515ba81-68eb-4143-a29f-51a40a65dae6}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{16C327FA-D8A8-41C0-B022-64AC67715327}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{16c327fa-d8a8-41c0-b022-64ac67715327}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{17468BC4-3ACB-4D2A-98C2-B0B7B4EF29E6}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{17468bc4-3acb-4d2a-98c2-b0b7b4ef29e6}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\AE09C984DF6E74640B3271EADB5DD7C65FDE806235B2CDA478E0EFA9129C09E7", "hashes": [ { "md5_hash": "cc3e8d276fce51e4f88c1006b5dc008b", "sha1_hash": "93d35f2df9917e7aaf340810564816c2c688c316", "sha256_hash": "a587adac0b3b0b4f0c3b840452be39769112f8b013ca28c494241c78ba627fc3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\ae09c984df6e74640b3271eadb5dd7c65fde806235b2cda478e0efa9129c09e7", "operations": [ "write", "access", "read" ], "type": "file_artifact", "version": 1 }, { "filename": "System Paging File", "hashes": [], "norm_filename": "system paging file", "operations": [ "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Videos\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\videos\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Pictures\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Music\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\music\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Libraries\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\libraries\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Downloads\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\downloads\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Documents\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\documents\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Desktop\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\AccountPictures\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\accountpictures\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\wyRSSbqc98w\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\wyrssbqc98w\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\nXLOUPBUSENPl3p-\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\nxloupbusenpl3p-\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\8kLT4Ds_WbYAiWWTJ\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\AJr9qN-J2iQXFfFEuVm\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Searches\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\saved games\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\V_voeP\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\6GHFbg6R\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\6ghfbg6r\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\onedrive\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\tcOtOe4F9FR69v\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\TfEyYXaoPWeg\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\tfeyyxaopweg\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Links\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\links\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Downloads\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\read___me.html", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\bootmgr", "hashes": [], "norm_filename": "c:\\bootmgr", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\hiberfil.sys", "hashes": [], "norm_filename": "c:\\hiberfil.sys", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\pagefile.sys", "hashes": [], "norm_filename": "c:\\pagefile.sys", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\swapfile.sys", "hashes": [], "norm_filename": "c:\\swapfile.sys", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\ntuser.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\ntuser.dat.log1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\ntuser.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tm.blf", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tmcontainer00000000000000000001.regtrans-ms", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tmcontainer00000000000000000002.regtrans-ms", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\WcaMW\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\wcamw\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", "hashes": [ { "md5_hash": "cda824c35f96337a7cb8425128ed2d4b", "sha1_hash": "badf397a72453babf239c0267ad39e720bf46cee", "sha256_hash": "8d3a4ffc3876de9ca4403f6ea9d263f5a93ff83e83cb5c065909528f05756d2e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\favorites.vssx", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\2xnCn\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Read___ME.html", "hashes": [ { "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8-smyN.jpg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\8-smyn.jpg", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Zbtp57yuqYSnW07xS\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\zbtp57yuqysnw07xs\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype\\RootTools\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\skype\\roottools\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\AlternateServices.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\alternateservices.txt", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\parent.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\parent.lock", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SecurityPreloadState.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\securitypreloadstate.txt", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore-backups\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\saved-telemetry-pings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\crashes\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\bookmarkbackups\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\crash reports\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\nativecache\\nativecache.directory", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\sun\\java\\deployment\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\adobe\\acrobat\\dc\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb.log", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\AdobeARM.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\adobearm.log", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\nsmA14E.tmp\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nsma14e.tmp\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access", "read", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vwOrbzLbc.exe", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "5da21af74810e3655bcbbe40660f21b8", "sha1_hash": "60d60dff0d3af3b564e43bc87ef5a63ff6146da7", "sha256_hash": "c0ce6c2f03e3174d347eb2136a230883a725fcd5179221f61435ea709a2ba81f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vworbzlbc.exe", "operations": [ "access", "read" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\bootmgr", "hashes": [], "norm_filename": "c:\\bootmgr", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\BOOTSECT.BAK", "hashes": [ { "md5_hash": "351a1e2354f9c0ccd36e00b75bb50a18", "sha1_hash": "e19f9661239c4fc761385ea3f39b00c9c2c35cba", "sha256_hash": "6f8e024373a23c013124ae16c0e7b38f583e44a252860f4c8380de99a38a9904", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\bootsect.bak", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Searches\\Everywhere.search-ms", "hashes": [ { "md5_hash": "67a89b1d4df7926bb1282fa543e092f0", "sha1_hash": "db060cce54618b30a81ef32e3ab32413cc98df51", "sha256_hash": "0f7ad004fc0f95aea113801039197f9c33c45f1953356bb603ab97c109396cd3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\everywhere.search-ms", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Searches\\Indexed Locations.search-ms", "hashes": [ { "md5_hash": "9f661fc1d668f3df14e769547e7beee1", "sha1_hash": "c7fc75a79d8556a2c8862f39a7bd13df6d800be1", "sha256_hash": "e81325733aa1be43630ecd9a9cba0cc6e69b9bf71ac8262233e05e8500eb5cdc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\indexed locations.search-ms", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\BOOTNXT..doc", "hashes": [ { "md5_hash": "dd4c03d383fa84a8ccba73e0b34a26ca", "sha1_hash": "7cda05877b6effc0ea603a0925322fde261c51bf", "sha256_hash": "2f1a8b66d168474c99923af0795a35c2cfe9386f64b8000fa24c6fa3402f8a90", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\bootnxt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\BOOTSECT.BAK..doc", "hashes": [ { "md5_hash": "351a1e2354f9c0ccd36e00b75bb50a18", "sha1_hash": "e19f9661239c4fc761385ea3f39b00c9c2c35cba", "sha256_hash": "6f8e024373a23c013124ae16c0e7b38f583e44a252860f4c8380de99a38a9904", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\bootsect.bak..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\desktop.ini..doc", "hashes": [ { "md5_hash": "03fa1e0ea94f96e88df614abbe0703b1", "sha1_hash": "8b6bf3c2e93724a603abc372e772fd4c8a1a154b", "sha256_hash": "237e277cf6439d70c327f263cb443e4b9f23e1736ec5e38d7e9c5a7490626473", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\desktop.ini..doc", "hashes": [ { "md5_hash": "4557a99c5f04dd51e1c57f88eecabfd0", "sha1_hash": "12b9d3fd9c7b25af9f6030245a9bc7b9a306cc6c", "sha256_hash": "87d3ef818691192276efef80fb2d80a1c3f14d4313fe59566429b9a45a62aa82", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Videos\\desktop.ini..doc", "hashes": [ { "md5_hash": "912937c3c9a69c32211d4162d9199fbc", "sha1_hash": "80e00a9c04a8cb36846da3917dcd095811cd586f", "sha256_hash": "d2f030314ae9d645cb32763ac0b66125eb38d718a64fddc090376eeb540e07a9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\videos\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Pictures\\desktop.ini..doc", "hashes": [ { "md5_hash": "84033410a1053c63dedc29d312a02fff", "sha1_hash": "a98610896d90d8323dc68135e79b714f585619b3", "sha256_hash": "120db3e5232d5ac034a29d84bbc28e14b7fd08333b515574643d086152052dbd", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Music\\desktop.ini..doc", "hashes": [ { "md5_hash": "19df54bac0c5e64d04110ed7d79e8a14", "sha1_hash": "3bc9092919086b28b62ee2e0ce7096b7e43a9934", "sha256_hash": "e7b4f0156e9e228454ba99d32e680487e680c7c7996cf48709ab54a2f42feb38", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\music\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Libraries\\desktop.ini..doc", "hashes": [ { "md5_hash": "14f972c6f596015135491f8d195c6999", "sha1_hash": "aa46c370e3f5d5119f63168eef8c897f1947eece", "sha256_hash": "7d0f57e87e3fe8795d13be2e4f2cf9d4a2c15afab4aa58929dbd517077ae520e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\libraries\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Libraries\\RecordedTV.library-ms..doc", "hashes": [ { "md5_hash": "e36f7f7f6dc87e0af8a6b625daa9899a", "sha1_hash": "e846d09023adbf67887ee86e8a01b32f826d94ac", "sha256_hash": "48ae42aa9a9bd8731f6d7b5cac820121c4adacb024ba9e772d6738b0928b61d8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\libraries\\recordedtv.library-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Downloads\\desktop.ini..doc", "hashes": [ { "md5_hash": "334326f2445576654b881ca75881a12a", "sha1_hash": "2154f40bf4c4189c8d3e963b05c853e4f2df3b12", "sha256_hash": "70b9f46cd1678b6200e585463d78b91d07ae8ca9f254590fe1d5ce152f6f770a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\downloads\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Documents\\desktop.ini..doc", "hashes": [ { "md5_hash": "fb9580698701e27432647edd2d7eaac7", "sha1_hash": "6781d39960831bab710c05f590166323646eb7da", "sha256_hash": "acce99a2039dd0fe6a4256f06e4ef93d4585828d8394bbb4aa8a4eca014888bc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\documents\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk..doc", "hashes": [ { "md5_hash": "8fdc81b4323f97687e071a50b5267496", "sha1_hash": "d36545d6fd09f7c2b574b68e120250347715a28d", "sha256_hash": "ee9058e027d4eb75fc3f979f72db86413401287e4aa18d33e073aed1b1e8547d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop\\acrobat reader dc.lnk..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Desktop\\desktop.ini..doc", "hashes": [ { "md5_hash": "9dcef2ab01e7b4f41c0de6a3df60f5b4", "sha1_hash": "c685c2f13bbdc51b92da09c4382477e0aeec75af", "sha256_hash": "f3f0ac0332a1aadae365c1b4afca95d14e4fb89d56a47ba7582ca72d40aa1cb9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk..doc", "hashes": [ { "md5_hash": "5e48a236139104b9b82eeb16cb72e0ae", "sha1_hash": "9b30a2145e9be12747754935fc14661731c1e125", "sha256_hash": "19d7b1b55ce79827f37860f46180bddaaaf35dd465eb4daf3098638999ab4ab7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop\\google chrome.lnk..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk..doc", "hashes": [ { "md5_hash": "ae617e94bd982a4ea563ede72ecdae37", "sha1_hash": "0d82d70473b3bcd4d3b1f525f6d86f4e1795dce8", "sha256_hash": "49d51bb8135ae652b9a764971120d484158e06f18efabf29543cd0d6676e57e8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop\\mozilla firefox.lnk..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Public\\AccountPictures\\desktop.ini..doc", "hashes": [ { "md5_hash": "efa39eb41053ff0a991c991975875bc0", "sha1_hash": "5d2c35f8ad96ecda5cebb27ea0f8885656c1038e", "sha256_hash": "5c4d71bd487cd675b674e5774c8cf24bdf86a8dd5204ec75693ea5960d20e216", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\accountpictures\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT..doc", "hashes": [ { "md5_hash": "d83dcac774dee521012189dc88cc3662", "sha1_hash": "0ab64335840bacbf8cfcf5deaad8cd0ee9f853ff", "sha256_hash": "5dfdb0284b4c5a586857ba6ddf5ac921171130b346bca2ff034c47b7d3a68d47", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT.LOG1..doc", "hashes": [ { "md5_hash": "9b22fc5462ac88989eac80428326c8b4", "sha1_hash": "de37ccf141aa88e2b36823c7f264dad2ef879d13", "sha256_hash": "0bde45128964856c98d7e041a6f984193f5e2fef9f6e2bae2fece8b8f4dda676", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT.LOG2..doc", "hashes": [ { "md5_hash": "0e555c1eade9bd288351ec55ece64351", "sha1_hash": "d8088abab0fa629c0a2ebd85b09495d004a55eef", "sha256_hash": "13e5d77a28442e6a35c101086e296861f4ea614b314da9d0fa7a9e098a8c7afc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat.log2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf..doc", "hashes": [ { "md5_hash": "57f5d78a1ec92fde51f041dc00d88054", "sha1_hash": "014d993b9c714e98da5f6c99cd385ec74353784c", "sha256_hash": "79d7a87a7868d9fa9c931d396517e6cdcd3f7c6dc3c6ba5110693181eb03fc7d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tm.blf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms..doc", "hashes": [ { "md5_hash": "48edec9d8fe3890abc8a341cf0a24a3a", "sha1_hash": "9ec639610f86974fa0f04d099995ab77e3123dd3", "sha256_hash": "2fa43cfae372a2f004aaee09c314d1641c334862115636da0aa35f5ede3c907c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tmcontainer00000000000000000001.regtrans-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\Default\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms..doc", "hashes": [ { "md5_hash": "57b2afe19de2c0e01e104353ce5c97c6", "sha1_hash": "dee459ee5a30f2ff682188a4d33e1c7ef200774b", "sha256_hash": "07ea3cf325f425abf86e54b86ec9924ea3c9d1cdc9f3abe1d0d4e4314d7212af", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tmcontainer00000000000000000002.regtrans-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini..doc", "hashes": [ { "md5_hash": "1524c23e29ca650fee428d62e876b108", "sha1_hash": "234adc81a95746aebf2e5f06f6fc63b13d3b814c", "sha256_hash": "a9a2ad3c5c92a5dc415de2e8578ca9d214a958f7b46d8dcd988d4503cf9e546b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\ntuser.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini..doc", "hashes": [ { "md5_hash": "bd3d4d5eb25d64e78a8dc21a5b0ce4c8", "sha1_hash": "5a860bd27a305d6e6af9b8d406836bcdbd0c3d46", "sha256_hash": "874beff6a5c1aa61d7c49a25dc23a22eb7b0aecf5cb5b45b455afb0f9d8b52f9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\E2waSdX2n_.flv..doc", "hashes": [ { "md5_hash": "a6d96e199780925d81c91bb4fa149841", "sha1_hash": "2f73ba8ed8f14895d10cd2ecdaebe16029c30df9", "sha256_hash": "2f0627608232265a780eae15074fba5f7be01b0a4c5e41c0446e1d75fe69d9c8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\e2wasdx2n_.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\iBTwm8.mp4..doc", "hashes": [ { "md5_hash": "869d0badcf60e04ecc2b218ed188b179", "sha1_hash": "6887e6ae6c26e10ef141116a800aaeb571cf40e6", "sha256_hash": "172284c36a0ac87fb5c30ff25ae5f18efee95ac312fe773b22785c795ff3645b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\ibtwm8.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\NY17G87uN.mkv..doc", "hashes": [ { "md5_hash": "c0d2b4ce573c4b64c6677f6bc37c7415", "sha1_hash": "162bba83fbbfe53f338d365cb2b95e54cdf9bd5c", "sha256_hash": "79985aa176fd5b4a528a40efbfe9cecbd6cccf6c168123134e4b7566eaae05b4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\ny17g87un.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\P1l10Vzx4hd3-C.mp4..doc", "hashes": [ { "md5_hash": "c4fcb29035a817cc14f45304c4d2490e", "sha1_hash": "d37b16597503b5bc72dd20ed9b0061565bce7841", "sha256_hash": "4c13bd5c2a840fe2698e48900d9e5a2d225018410104ab0739a6ee816197c36e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\p1l10vzx4hd3-c.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\U8xibbuO9vCag.mkv..doc", "hashes": [ { "md5_hash": "ef5e1f614a58744f99a63faae1f07cbc", "sha1_hash": "ad87228795e5c5f35f0beecae9535607c3b6ad2e", "sha256_hash": "2f0538dcb5a3fc252bfb660e65f218f482491202bc4cbac19e7f295507c5d1d8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\u8xibbuo9vcag.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cpcCB0B.swf..doc", "hashes": [ { "md5_hash": "77c363aa0b79f3d0d3668d81ecb9141d", "sha1_hash": "a6617a5f0203ea9c75a3012cbae6ab87f497f31f", "sha256_hash": "0e02cfb29fea57bc04a3c47f50279cbcd2b82bc0c8e71d36413805de1c73bb6f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cpccb0b.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\pglUhoTAS6kwMMFsDl.swf..doc", "hashes": [ { "md5_hash": "2ef50514bbdf5c1fb1d99df1003680e4", "sha1_hash": "f00a7c057ca940e40c09389e96080ff1d23300c2", "sha256_hash": "bc12ad5610ac4c5278903dd2afd1c8c66180a1c519ed54f4c998c8f45124de70", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\pgluhotas6kwmmfsdl.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\6e5-HpMrbS.mkv..doc", "hashes": [ { "md5_hash": "224edc872eacbcafe10cc214a8d8f606", "sha1_hash": "44217fb10c26be8043cb8e1f8995a7a0616d948a", "sha256_hash": "f88670028a1bc60e4b18741205e4d4a34f8cf076bc2a4d00e4c1e8b55619383f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\6e5-hpmrbs.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\6gwG.flv..doc", "hashes": [ { "md5_hash": "7727271b003ab118e5a7ee4f46935aa0", "sha1_hash": "06f4b83bf0e1cd5fe9a338e2d436627c4f634555", "sha256_hash": "6f53372a64e6aa4a87218501439ea4d762b340e2c876ed860b40d58d71b2dd92", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\6gwg.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\gxfzekk51.mp4..doc", "hashes": [ { "md5_hash": "2c531982707a0d2bf59074d62157b4b4", "sha1_hash": "2293b64dd2a55424b9324ee43e81126f8118e585", "sha256_hash": "62dabff92059c12969278fa6d0cd937db0c421bc9bf2d03b1862760d83749382", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\gxfzekk51.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\lI6eAu1sqq2.mkv..doc", "hashes": [ { "md5_hash": "cc3026377aba30e4133e5fce0bb76937", "sha1_hash": "157b1734ca63de36fba45139b374d21786bbc389", "sha256_hash": "47e13837c48b5d49d11675d8e387e57504166d0957c68d17cb5a03cf591e5bd1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\li6eau1sqq2.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\P17XSZAU6p5neX19v.mkv..doc", "hashes": [ { "md5_hash": "22b8453bc206080fbca0de949a9bff50", "sha1_hash": "a5dc55caddf3c00c8ebe8bd5c703256bad2da952", "sha256_hash": "1600762b28cd5fd906eec2d17dfcaba6fdd1d47cedc7c3e0dca77645667eca43", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\p17xszau6p5nex19v.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\qopWQzK.mkv..doc", "hashes": [ { "md5_hash": "0b1b91e03ccdf4eb9f73ee409be5e17c", "sha1_hash": "9a0def13f02c4680d9bb499e406ee70049789591", "sha256_hash": "09c06b2417d218510ae018c5572d9a6e473f7754f6ed606e960d4fe46bbc743d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\qopwqzk.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\u-MJrV.swf..doc", "hashes": [ { "md5_hash": "3349fa04afe142e3b99cd9812bdbd1e6", "sha1_hash": "7236a7fc759079d2bb585a4965abbf117ec7b37f", "sha256_hash": "3d6909f8e1048412e03a1e0b5a7154a7d7a693b6e95840098229dad9f0637f20", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\u-mjrv.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\wyRSSbqc98w\\JNgBvbxt2TE.flv..doc", "hashes": [ { "md5_hash": "16c7ee5f1fa526ac4802dc6b46685f2c", "sha1_hash": "763d4427b0d6e6b2b7ba36516c8b98296b18aa92", "sha256_hash": "307ecdb45c3220a1d9db865e5cd134b219525614fe2c5850504134fa0891b750", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\wyrssbqc98w\\jngbvbxt2te.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\gPYspNB\\wyRSSbqc98w\\XfNky9jsklLvnZzA0q7K.swf..doc", "hashes": [ { "md5_hash": "8e55130411fb86e461cac2b1786353aa", "sha1_hash": "a5fc0bd86905e48f5f8ebb054463e4671f3213e0", "sha256_hash": "ba3d8c13f3de0bde5ed1a4154c9f8de820891a8234c49417577feb9e2bbdccd9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\wyrssbqc98w\\xfnky9jskllvnzza0q7k.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\cn620-GsIa4nYYYCofJ5.mkv..doc", "hashes": [ { "md5_hash": "94fbaa99139c9d10a02bfc36ac9de466", "sha1_hash": "bc138ad598b761a24e0d0013cf64d86dc4fc140e", "sha256_hash": "b1e9c09cf2c3eabc1c4c394d756385daf0ed24b4c23a68d646b660fe6fea512d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\cn620-gsia4nyyycofj5.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\tt_X88h6 PABCl7r-.swf..doc", "hashes": [ { "md5_hash": "710e3b7a9024eaab14b0f4ca641b75d9", "sha1_hash": "a10e5dab1ca75408740ce320a4ffa30703ff4855", "sha256_hash": "f967457c20a83bece1ff8ab326cc7b6354c8f5ca9d37daf0c9511e6a4665faeb", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\tt_x88h6 pabcl7r-.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\z5nYgQLxCnl5CC-.avi..doc", "hashes": [ { "md5_hash": "aab7e0c401e157c1c2578244eefe5fab", "sha1_hash": "c238e5b64433873f13430a7d7210779ac149145b", "sha256_hash": "8364c334ff92f20ac6b24b1d8bf77b98421d16143a6edab55dc938b2a16743de", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\z5nygqlxcnl5cc-.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\4tNMmqDfQUCo23LOg.avi..doc", "hashes": [ { "md5_hash": "c3b8766fb80ddf42509e7f761928dc30", "sha1_hash": "b4d33f1cf53cecca4886ce8d2dc5e4db905c0a01", "sha256_hash": "8e61c5186a0dfff841d34d4dedba3589455dc0f82dffb09b3a809403ebf5d29a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\4tnmmqdfquco23log.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\9JZc.mp4..doc", "hashes": [ { "md5_hash": "4a6889191bccb24e074c8c8c38412edb", "sha1_hash": "f9b029cc2c1a8d832a6a3db9249ad9a536eb53ec", "sha256_hash": "2a526ea714599dcacb6bbbbbd4caba2866f483b2b8484a37a0855db68c9e19c0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\9jzc.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\fWOL9DBWif.flv..doc", "hashes": [ { "md5_hash": "7ca5c244029c3c8be3219c37cc5c6fa5", "sha1_hash": "df6bea5d708fb2afe2052673928401fd946d62af", "sha256_hash": "6face97dd1e3c6aef75551648680b05a670e34e8824462b68d627ccce635e418", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\fwol9dbwif.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\O8eEM2rfs_MY3eq9rG.mp4..doc", "hashes": [ { "md5_hash": "ba8ccb3fdcee2914c38bce0524e842b8", "sha1_hash": "65e64716db0da062105d70ba2afa2ecff90fd9c2", "sha256_hash": "f8d7120d341931fbbcfa46124bd7192f7dbc2f10d5e7d6bc33eee61c5cfa052b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\o8eem2rfs_my3eq9rg.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\XBh9XWX0LPZGgDjBITI\\cxqVyRkp8K1US\\j-xye\\s0d9d09EsgnYM8FvdWh.avi..doc", "hashes": [ { "md5_hash": "bd974c8625ad3b525bfcd5bc7ca38035", "sha1_hash": "cf8d51a8866500327d11a32696c56b6292be4561", "sha256_hash": "19f5df5f700308b91eb93b30ea24fee2c5bc10f2a74a357b97d244d619871097", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\s0d9d09esgnym8fvdwh.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\dINDjPM.mp4..doc", "hashes": [ { "md5_hash": "4ae1c4e97f55af4e88994edcace7da04", "sha1_hash": "3529e9ca4db6e2dde3252cb17311ffb48bff3801", "sha256_hash": "a777066c67f3326bd8de19d3d77345345d7ca1e7720329267caf479bc0368495", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\dindjpm.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\GppAg7bkp9yD0gqXY.flv..doc", "hashes": [ { "md5_hash": "36950664f74e1b45f63a64ad3198c4c4", "sha1_hash": "72fb97c7ca9c532b0d374e13d3edd23528b93230", "sha256_hash": "1a2b8b094e6ad3f6a08229865269e08f1f6b7addfbdf0cc8eb5d2a812e97ac30", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\gppag7bkp9yd0gqxy.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\gX_wpIDL1D.flv..doc", "hashes": [ { "md5_hash": "fc1b8206ef863f678da28ae60ff32324", "sha1_hash": "ac7999e33a532a057f2bc5c5002cce9139377fc1", "sha256_hash": "1f314cf51e1aa8b12f451de8f0b25133200e20e8562e8c1e3cddf5305e91e0b0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\gx_wpidl1d.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\nXLOUPBUSENPl3p-\\WnVoa3g9JP.avi..doc", "hashes": [ { "md5_hash": "a937f1f839db02afb42d1607d1ded6e0", "sha1_hash": "3e0379560c88f8c49c9bf53d4a2567996f17b929", "sha256_hash": "4f33edcf69278ac37b940a4eda0741af35ba6b54d261723c27518704e82676f2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\nxloupbusenpl3p-\\wnvoa3g9jp.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\8kLT4Ds_WbYAiWWTJ\\29fvAWN e8KITEzwwn.flv..doc", "hashes": [ { "md5_hash": "43ec61be6fd526095167936b71b9c80b", "sha1_hash": "e60eaf40ee03bb331bf4f80570e2f91048e553d4", "sha256_hash": "2e6d24776764e1a69b4cf04bbe6938b2fce888d9e0a4d92086bb7c10ca2745d6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\29fvawn e8kitezwwn.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\8kLT4Ds_WbYAiWWTJ\\a6mtdOtp8JU.avi..doc", "hashes": [ { "md5_hash": "3608a2b7bad77eb62fa08acc7860790b", "sha1_hash": "1fddce70e9c76b8e19e6a8cdddb037b93816aa9a", "sha256_hash": "4f570434413579e169995ce8070bf8d8532d0e6bb283e81e3a13d01889815f69", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\a6mtdotp8ju.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\8kLT4Ds_WbYAiWWTJ\\eZSH9_U.flv..doc", "hashes": [ { "md5_hash": "9592d4228871918fe89dfd41f35f2519", "sha1_hash": "576536644a6cd6cef1ebd34f0f61f6332396b24f", "sha256_hash": "7f449b69ec6e80ef67ef543350e12f2af51a60d7e5a3a89d404f822ac7c5ce8b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\ezsh9_u.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\8kLT4Ds_WbYAiWWTJ\\WALJYrB.swf..doc", "hashes": [ { "md5_hash": "9054674649197d9a0c4cff7331c123f4", "sha1_hash": "9de74aa70b9160dcc0454a2b60cd84c6960635c6", "sha256_hash": "a4c07abb692ab47758373a5430088a0fdbc7a5328eaac1f0cf8f5d9439b9001d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\waljyrb.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\AUvU5OO_3GglwZKK.mp4..doc", "hashes": [ { "md5_hash": "59c24a41d3b59a62c2332684cdf7a2c9", "sha1_hash": "b3d8f3ba307b40c3d24350621282b6a707fee3d1", "sha256_hash": "377ae13f6d315cb476f6b2e70531ee2b56e4b479b8afe2a0e4f7d50329c91673", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\auvu5oo_3gglwzkk.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\kMLEB81EE9b5N1X.avi..doc", "hashes": [ { "md5_hash": "998056d7bb4782afc1fe5dd83831b349", "sha1_hash": "a0d8bdccfeb75d91c92c37ef9c8e27270ca66123", "sha256_hash": "e57bb617df558bf06851dbead8bb94a488a7d59f0585d9b6d303737e76212765", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\kmleb81ee9b5n1x.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\nMnO7w-y-y.swf..doc", "hashes": [ { "md5_hash": "afbc6aae9a38e174bba006c3eed12fb1", "sha1_hash": "8e2afec244434d71356ce99f54eb2a060b186fd4", "sha256_hash": "d722f4cc88e9845f795364929d9a39dfe3dceeb94a6178c498d5fc984797d047", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\nmno7w-y-y.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\AJr9qN-J2iQXFfFEuVm\\fvNQxqgywuA5.swf..doc", "hashes": [ { "md5_hash": "08cf7a35d11c46ef9f2636134600a86d", "sha1_hash": "2ca70859374af74b538e9d2dee9aa5c6f07076a4", "sha256_hash": "d7207d75687dcc2265408367f777e000e2ca602cc61940275efa6bc1dfbae30a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\fvnqxqgywua5.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\AJr9qN-J2iQXFfFEuVm\\INOm_Uv1I78K.avi..doc", "hashes": [ { "md5_hash": "3f0d9b18e92cddfe21eb116820e72a56", "sha1_hash": "8f78ef7d1c1cc1458b83ac4f6f845449a9464bf9", "sha256_hash": "dd2ce7ba60461cb0302fc03576843773928d1fc4d13cf480ca79c2b516825a3d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\inom_uv1i78k.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\AkFTbjqu7\\AJr9qN-J2iQXFfFEuVm\\l6wYbM_D_r_.mp4..doc", "hashes": [ { "md5_hash": "df53e775ef95e9d4c47ff79c72935cc1", "sha1_hash": "53ed9157075b7aa18ee2abec0419a623c4acd2a5", "sha256_hash": "58c9eb8125df9d1653c419f73e3dc5d0528682a8bd74a47209ba75802c678fd6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\l6wybm_d_r_.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Searches\\desktop.ini..doc", "hashes": [ { "md5_hash": "c4c1f7faeaa84afea0455e3ad7466095", "sha1_hash": "f53b0cc38d4f8c6b30926e357e63d6cbe5d5166b", "sha256_hash": "7fc129f00a30303e0fae704350f13d9534be76909e6961261677e3b75d960a80", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Searches\\Everywhere.search-ms..doc", "hashes": [ { "md5_hash": "67a89b1d4df7926bb1282fa543e092f0", "sha1_hash": "db060cce54618b30a81ef32e3ab32413cc98df51", "sha256_hash": "0f7ad004fc0f95aea113801039197f9c33c45f1953356bb603ab97c109396cd3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\everywhere.search-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Searches\\Indexed Locations.search-ms..doc", "hashes": [ { "md5_hash": "9f661fc1d668f3df14e769547e7beee1", "sha1_hash": "c7fc75a79d8556a2c8862f39a7bd13df6d800be1", "sha256_hash": "e81325733aa1be43630ecd9a9cba0cc6e69b9bf71ac8262233e05e8500eb5cdc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\indexed locations.search-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\desktop.ini..doc", "hashes": [ { "md5_hash": "d2c3bc6c2e874a4e62d5752742d6a26c", "sha1_hash": "fca1d2e592d8698781d386f7ce2d310384c5853f", "sha256_hash": "2268250d88125d513d73334d7ecfd5c0ec075c5639646ac99e17bf8220e96c67", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\saved games\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\0hK3feRWLwMDEGNQX0.gif..doc", "hashes": [ { "md5_hash": "ac9f3f9c26338af80c9ba05a1b5f64b0", "sha1_hash": "e43e831e8a6648909cc0480f02a6a1423f148ca2", "sha256_hash": "d2688170b4418761121d914e2c7573fbbe6b326b9544be772c99d3ae547efbe1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\0hk3ferwlwmdegnqx0.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7QDjRW-YOMo-k-Z7n.jpg..doc", "hashes": [ { "md5_hash": "2dbb0b4cb0b8acf258f575c13848af0c", "sha1_hash": "4a2c061fc5e340860ab6b2f16d5f2ad1d62e2e82", "sha256_hash": "e6dfb245a478614c79c30c89345670b51f6182c37bccc7ce258d19076ebc8d4c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\7qdjrw-yomo-k-z7n.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini..doc", "hashes": [ { "md5_hash": "3dbf9c15339199ca1e20853ace4b31d4", "sha1_hash": "c9b06d0f911c553a516f1e3066fcd1f3af08a473", "sha256_hash": "4d8b6c410fde466c6a91419bd42ff117b20a0142ecbf655f2b5c7e18e2b30157", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\H7tRdZQ_5G.jpg..doc", "hashes": [ { "md5_hash": "7caf7deb64e49cce7593c857445d9707", "sha1_hash": "8245ac00ca2d1977b65a96d15aa601001ff58199", "sha256_hash": "6bdc520d1fa0813a5849e335f463903b59082bbac8a66c5143c26cd9b539fcb9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\h7trdzq_5g.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qRw9a SAHnUzYrBRoXD.png..doc", "hashes": [ { "md5_hash": "bef17db6f8008201e2eee7fd8215e509", "sha1_hash": "ca910c5addc99824de22d683676ab0e7bbd0c802", "sha256_hash": "6255803a4dd36fa4b6b32c5152151fb9414794203bcd7b676c79d12731a1cb03", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\qrw9a sahnuzyrbroxd.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qTvKCWKzZwIBwteiqbM.jpg..doc", "hashes": [ { "md5_hash": "6221a08d21072faca2c26a7097305663", "sha1_hash": "339bdab658b3cee4b1dfbd555d67b97fa002a177", "sha256_hash": "f5ff60ac82babbb8ea59c7690f6ed00abbd182317eef555b0864a53b2e802b3d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\qtvkcwkzzwibwteiqbm.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\th8eU.jpg..doc", "hashes": [ { "md5_hash": "cb536c6ba05ad084eff49534b411798c", "sha1_hash": "791af3ac7e44f90ef0aa93c3c6aed09210b47f19", "sha256_hash": "616f462f32179ebad3ccc620412868de4ff8653e13f2a0f3407afc4c3d4707d1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\th8eu.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\XphR2TJjz.gif..doc", "hashes": [ { "md5_hash": "6ffd4e7f9b56f035a66f15814759b63a", "sha1_hash": "2b1d5c41a36841dce08c429493aa8041277a6029", "sha256_hash": "3271d5f78d0e0a9d15c4c0434ae1beaab48fdbe953f649d7be9dfae66fce2f7c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\xphr2tjjz.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini..doc", "hashes": [ { "md5_hash": "b0d042871f93477b4b37c70d7629837d", "sha1_hash": "66ef0c636edc9f29d4ccf63034dc37e8ebf88ec4", "sha256_hash": "af01d088ccd7258d620311b66d6308413f9a5b618df0a162b66461913890d241", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\-9fnhCfha2.png..doc", "hashes": [ { "md5_hash": "a8594fdd545b6bb17c417f4873165714", "sha1_hash": "a886b4e80fd4f7e4e1c6f891c045b38ab0997118", "sha256_hash": "748f2bbfb8824b5e10ae6479c549f6f69647d25377479cf85b58529ddbae894f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\-9fnhcfha2.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\9XuHi63.bmp..doc", "hashes": [ { "md5_hash": "cba8de21ea1a126cfdc94024e40f0f55", "sha1_hash": "46e1f7efd4a53808d430e12adfd8728f315abd60", "sha256_hash": "f4d65c1671191464475c8d6c7f61bf0d8fe07be14bbb27977cc3670f0612445f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\9xuhi63.bmp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\HKqhG.png..doc", "hashes": [ { "md5_hash": "12d9125b7719dd59f98119fcb76c7cde", "sha1_hash": "982c5debeded46dfe4e4a251971702301159bbca", "sha256_hash": "046e39766f992c5785cc76142a09abe4fd9b305a4a0e0140a6c8370b455740f3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\hkqhg.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\qhasofuRdPJwbI.gif..doc", "hashes": [ { "md5_hash": "30578e80f0a80370a8c6d465f0b1a195", "sha1_hash": "6b3b47784a3652ac50e44ac130d71389ea8a1e0e", "sha256_hash": "b930acfbd9d9b5cef9f2e53d1c84765da1a6990c42e78fe247e944fc3df4caa5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\qhasofurdpjwbi.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rtEvOrrNW0Ui5otj\\x1B_.bmp..doc", "hashes": [ { "md5_hash": "5b0b91210560fe6519b94a7b619c691e", "sha1_hash": "f0db99e5d5cfc01b857635cd9a84645f36ddd0df", "sha256_hash": "9c64bffd9d021a4292cc55882a66fe3c6b7b7f4288fe1fba6603618de6168d0f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\x1b_.bmp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\as7LziUTZIvnQsdmiXNj.jpg..doc", "hashes": [ { "md5_hash": "5e79772c1bf60f453460c5abc32d5257", "sha1_hash": "d040eccbbb921c559a00c81c2c9ef27f7a858bc4", "sha256_hash": "52e64a74db7f147f4477d73874694bbdc93daf35f83e04fdefd806236b6098b3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\as7lziutzivnqsdmixnj.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\D_Fv7 PRSX.jpg..doc", "hashes": [ { "md5_hash": "0539fa8eac70342f38f39a2aff0b53b9", "sha1_hash": "a798f721381034bebe68604bdbe2a66366a29705", "sha256_hash": "94e9f7d040b6f5608c78adbae3b61bd895e3b49e7edc0f97b227d620aa2eeb47", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\d_fv7 prsx.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\kOVNpDMYRL.png..doc", "hashes": [ { "md5_hash": "53ba80cd0472f0698fd1aae0d73ae925", "sha1_hash": "9015b1b9c7d81a959e33946dbc4bc036cc7a4457", "sha256_hash": "48f027c9baf7222c23df41960d3780f75b4f169640f35b92be2cd2651c96a3ce", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\kovnpdmyrl.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\UgMctukfcXoBe.png..doc", "hashes": [ { "md5_hash": "077d2fac723f1cbd3d6bdfc1fcccc4b7", "sha1_hash": "c97904a3ff6a9e73ad38051e05e87decaba9a221", "sha256_hash": "7d919692580b8bd577a1360c5506249a580d1ffb78bc03f2cc07ed3f6a7e4f9f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\ugmctukfcxobe.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\kuEb8-SMvM\\uLsDCVKQEuXlv ur2Xy.jpg..doc", "hashes": [ { "md5_hash": "ff38a4f3373f37969a54c7ceb6223b9c", "sha1_hash": "22ddf8d15fc919b28ac880548c7fbf0d4b8aadb5", "sha256_hash": "de26b309e0ba1723040055c01ca175326fdb25658c5d4f2678435b16772834b7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\ulsdcvkqeuxlv ur2xy.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini..doc", "hashes": [ { "md5_hash": "5cca10bd6c111274005acf6f8db9d76b", "sha1_hash": "8ab4945701ba3219e2ffdb58726d345c4dd79d48", "sha256_hash": "bd7dadad415f1e07336a09ada99a12632c47dcf7fb5a6de72ab9eaa5044856ef", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\3kc4ZE4GwJhznR0Zwjv.png..doc", "hashes": [ { "md5_hash": "e91fcc5a22a514f23ab756ab8e965e88", "sha1_hash": "50d754005ca12f35030bb9fba64998c17f460fa7", "sha256_hash": "d05103743b01d72da17f90cf0c1216ca7a9e01164df05337456444675c02b070", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\3kc4ze4gwjhznr0zwjv.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\8FsduI62A 2PMyaCYJT0.jpg..doc", "hashes": [ { "md5_hash": "af89d4843dfef53adccc8dc0ef2a8934", "sha1_hash": "ba1d212d9e0133221334f84effe4ede67597d01d", "sha256_hash": "1131be65c1eba551c686f4ddbf5edd84f43f0b8720513530dea691e502479026", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\8fsdui62a 2pmyacyjt0.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\9n-4.jpg..doc", "hashes": [ { "md5_hash": "97f431bcdb02fb152c69f0fe02419e3a", "sha1_hash": "fd31cbdc91fa71fb9f18e29dd506905f0d5ea307", "sha256_hash": "760a7a2b099cc37d79aca7c4a44fdb8a970d0224b4f69ba64fe2f3f0bf797eb2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\9n-4.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\BaYM9St _GUc-pMf1k-.gif..doc", "hashes": [ { "md5_hash": "d7bf4fbff69ac4313be002d49c76f39c", "sha1_hash": "79effbc7a1827648436550239433a1bed1ac4f69", "sha256_hash": "1674d71148be864775ed3c1c68f6b6ade5ad27d3abc77314c90e6c00a5df3a51", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\baym9st _guc-pmf1k-.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\dy4knw.jpg..doc", "hashes": [ { "md5_hash": "542c2e3411ca3a681549cc1a98856d67", "sha1_hash": "01408887f8b4fca7dcf925b8245e4c15a2515a96", "sha256_hash": "58b689bb52fd767c33954049f14b10c91a6a5e148eb8104127d0161ad3a94b62", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\dy4knw.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\gFe4.gif..doc", "hashes": [ { "md5_hash": "77fd1a6a20182d86d798362c119dc482", "sha1_hash": "2219754d4bd725d44bf411c526c41480bc120186", "sha256_hash": "1b378dd060e864fec50e1db866c4ecd212f948212c33fe804da903e8c2afb62a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\gfe4.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\l6xsWM755meyJgKN.jpg..doc", "hashes": [ { "md5_hash": "599d1503d5df5884c705682574796908", "sha1_hash": "67d2f2dbdd9e52832ee21483d65b390ca534c5a9", "sha256_hash": "54081f08d706f60074bdef6e7f8d10c61d2a80af9c9ba8378c7c2113ac986d44", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\l6xswm755meyjgkn.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\olgvHwYDQYI0LAKBu.jpg..doc", "hashes": [ { "md5_hash": "bc53f8db3d2219662d16428f33bc9c3d", "sha1_hash": "42a4788a39c115d40c18c403c17c08927ffee412", "sha256_hash": "5ebb588dec0ad24e05480a2eae6bdbd0ad2650eb2b6e1447587cb65aab269859", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\olgvhwydqyi0lakbu.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\rjZGheo.jpg..doc", "hashes": [ { "md5_hash": "4011b193c3ea477cbdb7878b5e6e4ace", "sha1_hash": "e365174a03247c97fc9ee07248498d3f860b80a0", "sha256_hash": "ebe9f6bcf0406f51ec1360024a0baf809abfc4cfa9c8f54e2acf6545eca4a6fa", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\rjzgheo.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\V_voeP\\5b OpcYK DpCOz.jpg..doc", "hashes": [ { "md5_hash": "bf95a5b5530da4c567c457a7405ebb09", "sha1_hash": "62aa0ee530b1684ac4a3308d1a226c8a2b999a45", "sha256_hash": "975f8a21e4602b9515be89d331d38b1155f9259adc53e09f3e47707f91236b48", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\5b opcyk dpcoz.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\V_voeP\\ePXXKIHHqhnuU6fk.png..doc", "hashes": [ { "md5_hash": "4c7f676d50a765b1c881721991fe70a9", "sha1_hash": "ff225983c83fdeac6d24e00bc28690dd9ebc0d23", "sha256_hash": "cfecb0949cb1b424b3b14aade255d501e8960e263d3a5311e896ed045f6374ab", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\epxxkihhqhnuu6fk.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\V_voeP\\PTUT.png..doc", "hashes": [ { "md5_hash": "5ff39262daafd22d49661e9bbb4937fe", "sha1_hash": "cc287a3da490d7e841759a957fdec13e4cd82e2a", "sha256_hash": "796c0c58d34b7be60b69345a52494b8f3ff6261ae18323719503e17a125350f4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\ptut.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\-5LN7dOrug9.png..doc", "hashes": [ { "md5_hash": "928d739af09a9f89057dbc12faeb53c2", "sha1_hash": "f35051ec0f0ee9850b1defa2e76b16027bb25166", "sha256_hash": "1a1169bfb1d5c2c7dc22af9cf6bd0745973a62b94c2b415598c747335a0996a7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\-5ln7dorug9.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\F0XHzrypqok3ky78oShS.png..doc", "hashes": [ { "md5_hash": "1ab1ac77b6519d6d5e64284749dcb175", "sha1_hash": "2cabfec4627b0f99dc431fc378822716385c6030", "sha256_hash": "00765bc7e24a8493a7d6b86414551b3ba60a33561f631a3623b61aea3c578696", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\f0xhzrypqok3ky78oshs.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\i39wbFUmYP6Nr8Z.bmp..doc", "hashes": [ { "md5_hash": "b44ff50eb8a7d805974b9d748c93fb52", "sha1_hash": "7c511012208b5d52b8610795bc4519f2ada50ab2", "sha256_hash": "ef5a76511fdbdd3bee2f4d07fad1cf1a1a805be55af41705faa2daa9daa51996", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\i39wbfumyp6nr8z.bmp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\maZf5-.bmp..doc", "hashes": [ { "md5_hash": "f0bf7f7c785877b62a459ffb5e32ebe5", "sha1_hash": "2535230322be3bc8a95c223aed64435dfead5cc6", "sha256_hash": "118fb7d5ede3c8190d5bb77935b2e3dd7026a03279099e7cdb00b1ff89b374c2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\mazf5-.bmp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\tlHDeOF6PKJ-_ruMjy.png..doc", "hashes": [ { "md5_hash": "04b3c7e69561c2888e7a5b84ab9f6d59", "sha1_hash": "e8a412c9f56fbe883167bd6ead7bfbd42fe9d44f", "sha256_hash": "d87875105600cd1c0aace4d8bf777135cc51328c22b204a295090c9a68e6bb7e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\tlhdeof6pkj-_rumjy.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\aBVGEclAKlPmc\\tq6haLxMyM.jpg..doc", "hashes": [ { "md5_hash": "786713f927ab73bf30c7519cbc9a0544", "sha1_hash": "75676b5f9d301b1e37d5c1dc2ee5e82cb9ef5045", "sha256_hash": "4be5ad07ac1aa15652184451374b3b874826fb2d72643211aab4b92a94f8aaed", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\tq6halxmym.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\9WI6Gc3O9CZj\\6GHFbg6R\\YDgP6n.jpg..doc", "hashes": [ { "md5_hash": "f9684a45f6842e4b1cc3d62a8aca8d0c", "sha1_hash": "dcb6b5f5d6420e92473415630a11c074c865fb1d", "sha256_hash": "d5d0e1ac0f2c1b53ffab0344f4f54556ee059759fa7e64d61a8f952daa9458a2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\6ghfbg6r\\ydgp6n.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\desktop.ini..doc", "hashes": [ { "md5_hash": "0072fd5678c831e896556403c9a56dc5", "sha1_hash": "e5f5c7cf7b6d6e5ae349dfb6fb2f02f95130a79c", "sha256_hash": "cc05acaabf026ed6bcd29908ae5079735617583855e4fd6557d8e310154af02e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\onedrive\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\-gv6hl.mp3..doc", "hashes": [ { "md5_hash": "2c90f23fd3114719e5dbaa82caa89f90", "sha1_hash": "250d53eaf9025c4559cdaad0b27f7ed435f1a782", "sha256_hash": "ebb0613399cc729b99177b5ebec4f245500a6e66ab9a052f92910d6937d6f691", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\-gv6hl.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\a7bhmQQgp.wav..doc", "hashes": [ { "md5_hash": "b0fa6eab862c042066dc38fad71cabef", "sha1_hash": "7d348ab645d083ceed008810414fa7ef7a44e201", "sha256_hash": "4fef77b6c8e7f4996e016a4e24c274e0000ee2e3f7efd1035b233bef8ab84ed4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\a7bhmqqgp.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini..doc", "hashes": [ { "md5_hash": "c97099a5ebbc80d50d309d865880682c", "sha1_hash": "4ca5f47e27d62693879f719b542b2904b0563b56", "sha256_hash": "ad3c0c99182392975db23272978191ff9571c70e703c03a405338a777fc58be2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\FGplqZx T.wav..doc", "hashes": [ { "md5_hash": "0c76019d1dd59733e76144c42f6bab95", "sha1_hash": "dc9544ecd70bbde7a47e1c8e0566a7cd56a77d93", "sha256_hash": "b58d31ec4f4db1e03b94ed836f0da1d41d8e7372525d6496b5ebfd8e132bafb9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\fgplqzx t.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\dckF.m4a..doc", "hashes": [ { "md5_hash": "b007a5506f60a4dd110bacf3020a385f", "sha1_hash": "293f8367e9af5a7fdc6c0236488f35e37d4efe47", "sha256_hash": "553dbc1b733af0c76ef0c3f3c7e922952243f6369c0d1ad8466168573233207e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\dckf.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\DsuPk7Zl9jC7_Qd.wav..doc", "hashes": [ { "md5_hash": "e4093144803c7ad006ee5d2eae5cf5b7", "sha1_hash": "1b5493aa25f317782189d937ad5ad82a9559a407", "sha256_hash": "7b515183cebe5db526924ac367d388c1b837ab659c206cd5b099496a656cc2a8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\dsupk7zl9jc7_qd.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iPpvCsEpbFWDeLC.mp3..doc", "hashes": [ { "md5_hash": "f0ea0deefa136587fc6a510b1395a251", "sha1_hash": "368a7817564586557f049a96d4f24a32ddb462c7", "sha256_hash": "b8044b5eda6fbb828bddf30c03b8139cb8305c0d586d4b85f6e609ccc082259b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ippvcsepbfwdelc.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\OZuWUdusfQN.m4a..doc", "hashes": [ { "md5_hash": "f27d09d9b1f2a01da155b43943031bca", "sha1_hash": "bba3aabb49cc0b4117c0b02e9cbfbe2aba2928f6", "sha256_hash": "ad5581fbde71925b779c79b29baa5e2c9979765981b5bfd5a363769352d45b4e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ozuwudusfqn.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\vnzuUiJUN.m4a..doc", "hashes": [ { "md5_hash": "ac7657ac37ab2dad3dede5f0bb1907d1", "sha1_hash": "e78532985ce0a17447226d5d6529395226052e9e", "sha256_hash": "7dec2fd091ed96b53bdb35ba628a2e527e75c675c448c52eb05cc1f1f8709102", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\vnzuuijun.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\1fc6VHDHWaiUXR.m4a..doc", "hashes": [ { "md5_hash": "6357bc54149cba544428784c0433f230", "sha1_hash": "bcd5d2cae4b888848a90ca8a63b37c4c2050c095", "sha256_hash": "abdb19f2f52b16492433c58b4f3f92079aaeac3298aed2feadeaa188e07db67b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\1fc6vhdhwaiuxr.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\D0I5ilhq2CC66S_eALG.m4a..doc", "hashes": [ { "md5_hash": "58feeb6c0a8d6b8c0ff50d78f28885e2", "sha1_hash": "9cbbc6031e6808017669df470bb7a2e63f519f5f", "sha256_hash": "608c971dfc4e0319f8e435d89976c085c51bbcfe137b7b7960a0fa7c2d5897b4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\d0i5ilhq2cc66s_ealg.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\esxI.mp3..doc", "hashes": [ { "md5_hash": "733585550054dc6ed95b4ec83420b6f0", "sha1_hash": "aee3d0171814ba4e53f0868835b27937873dc417", "sha256_hash": "1343c6dcadfb0d04b39cf0260b68f5ab7b4dabbff0ee7c9fd5efd9b6c3932b40", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\esxi.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\Ew3rSNw.mp3..doc", "hashes": [ { "md5_hash": "41e5deb048024ef38b94630c5223d365", "sha1_hash": "76cb14460a77226515cac081e58ba731df533f49", "sha256_hash": "2069c416c8c16ce33d9b02a204f4194825afec85e895221cf0cafe7e7e8655e7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\ew3rsnw.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\i42JoVPAE6Wr.m4a..doc", "hashes": [ { "md5_hash": "0fb34c7d0f053d21d608b8ea277b28c9", "sha1_hash": "90d40ce6670dce890cd09d346d68589b5b03ea9c", "sha256_hash": "a6f18da0473a435fd9b31667fa1ebe8e5db1d75f7f44ce1b50a7c7bc9cfe11a0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\i42jovpae6wr.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\k4EN3jl_.m4a..doc", "hashes": [ { "md5_hash": "fc490dee92d7ba28af2adb66db5aca54", "sha1_hash": "0d53566be4a391be7fd715af4f31941e4734803c", "sha256_hash": "d17ed4b8b9c6579694c17462c1f333a4e22b46a4295a3371e3574098cd62a4af", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\k4en3jl_.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\Oc7NraySLdll.mp3..doc", "hashes": [ { "md5_hash": "5d845b1ddf14fd713ba167b947d98559", "sha1_hash": "50c9348cb4ef95a6400be8c1a87e9d15ee4c805e", "sha256_hash": "4fe8205178e31f39942f682e989f0b38661366393ee36e9dc259474709c46f13", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\oc7nraysldll.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\605WO0IG7rv 5Gkzsb.mp3..doc", "hashes": [ { "md5_hash": "92d8cb8ebee0bb258d0ff45bba2bb6b7", "sha1_hash": "db1c51175b3e42a1fd0f2adecaf54c364c036438", "sha256_hash": "b6077ff7a2a3ba47b36a1db551aaa36cb0d2e47f679429bf0550b60bd3429903", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\605wo0ig7rv 5gkzsb.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\m1rlMk2aKfhDRFd.m4a..doc", "hashes": [ { "md5_hash": "a04e323349b77ad51775718d94d07295", "sha1_hash": "5ced5c633cd764396f3a66ebb33d70580c85d05f", "sha256_hash": "3452a2c547fa86a8458aef3b7df4401e93e4881d2d4ac252d3a78997baacca2e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\m1rlmk2akfhdrfd.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\PGszj43skZY.wav..doc", "hashes": [ { "md5_hash": "b00326eb8d130047caf56c0246925ae6", "sha1_hash": "9eb3ce342b9865c336423eb839a1ae6568e87c31", "sha256_hash": "6e315628f59f2919f8329c624e822f963db94a8c92a5316a6509b5922ec13ce0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\pgszj43skzy.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\yx7Ef.m4a..doc", "hashes": [ { "md5_hash": "8d82a8ffae788d669b9ddcb04b39e04b", "sha1_hash": "c24f5f84cf5b6027643abdb0b74cd3285f2c3507", "sha256_hash": "addfb6544509b015e79c673160ee3a6a393fe52ed68c442f13f37c7d811a1339", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\yx7ef.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\tcOtOe4F9FR69v\\lCE5UuOv6Td.m4a..doc", "hashes": [ { "md5_hash": "21afe0d57dab129e4eeb2e0f8e9e09dc", "sha1_hash": "b2ae5640ce2ca2aa9d3cba017b0dba6fa76da4a1", "sha256_hash": "7b699621de7ead27680c2377132ad87d45f5d012aefddf3e1d5c8047f5bfa917", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\lce5uuov6td.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\tcOtOe4F9FR69v\\vapNw9ByKw_HbBp.mp3..doc", "hashes": [ { "md5_hash": "aaafcd348ec71e590e2674469356ab02", "sha1_hash": "259d3d85b41f3dffbd7a4ce1fdc551d2e574bc05", "sha256_hash": "91469c74b9970b2e4165a35e9ffcaefd5436e46e62aae2f9cd28239595240a08", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\vapnw9bykw_hbbp.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\xuEFHwNtl3mF5OMdlBH2\\tcOtOe4F9FR69v\\X9TnF17Hn1X0_EkcrC.mp3..doc", "hashes": [ { "md5_hash": "4b8778a5461ddfcf01ea1ffa74ea30da", "sha1_hash": "3e638590c658fe9271f7477afe57ac074206fc65", "sha256_hash": "16cbb794377ac9e0e71a9f831909d91f264fbd8422c7bcec1abbf2eaea76f31d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\x9tnf17hn1x0_ekcrc.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\TfEyYXaoPWeg\\JFdazS.mp3..doc", "hashes": [ { "md5_hash": "bc1906627c022794f5083fa1e9d4e445", "sha1_hash": "ef5af09875614c367f09e0dc4e64ba5f42b108a5", "sha256_hash": "535dc7348f9508a832322bae74043c27fd59e5a4599414213f0b8a2cc3b8bcbe", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\tfeyyxaopweg\\jfdazs.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\ZOPz\\iA1 8yOgktf96\\TfEyYXaoPWeg\\Pm7OTm.m4a..doc", "hashes": [ { "md5_hash": "0742e8a807ed2e32afa17686ec6dc692", "sha1_hash": "374f1e1b03d2823d1ff6ed9b88bc358e4fb4ffe1", "sha256_hash": "e9bb179e71217f4746c63941d9a67f59bbe38ce7de4a4915e5e85698f1713001", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\tfeyyxaopweg\\pm7otm.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\E 0yaVCuvr4xTgj0s.m4a..doc", "hashes": [ { "md5_hash": "6f6e2ecf0db7360f0afa5728831559b0", "sha1_hash": "78712f3c9015a24e34501d4c8ae43ee5d8c8e0eb", "sha256_hash": "45c7f50ca9507476362466b3479653a594b24af40b6f24a50c80f8c6ba341e36", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\e 0yavcuvr4xtgj0s.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\i30GiOiXB.mp3..doc", "hashes": [ { "md5_hash": "c9bb8b82d67c18188946bcede0643e96", "sha1_hash": "4f6d8b6496fa017b30da91e5458de9793087710a", "sha256_hash": "153ddd4d181120b7dd545a44dad7dd2c4be1cff9c5889dd29b13db6e55e12aff", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\i30gioixb.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\IkM7 z01-mol8Cw-v67.mp3..doc", "hashes": [ { "md5_hash": "ab1d36c557cd637ebc23b477c76d6c1a", "sha1_hash": "86233756e704378370f81a345f646e9ff955ea88", "sha256_hash": "aac3772f64ce5e546a77ed492e4ac3ed20ffb62400871d1c062f40ed6d2c5f82", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\ikm7 z01-mol8cw-v67.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\mRwbv.wav..doc", "hashes": [ { "md5_hash": "427a283595977e77ae73ff64ca7f54fb", "sha1_hash": "b201e0f59f05cdaae03c84ec51a47080c5e0084c", "sha256_hash": "3d30b015795eb0cfeb5d510679701fa0ba997a347999d9fc535f83e38d3914c6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\mrwbv.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\PPQizB7psZmEP.m4a..doc", "hashes": [ { "md5_hash": "3a3a2f0cf688051867da1a102a06bf4c", "sha1_hash": "e558e3eefb5a2fe5b3ba3aa19ed33f932b3fd77c", "sha256_hash": "8b24602303558287d88743d316d682a4638f2f25f6ba91ba7eba107f102b7675", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\ppqizb7pszmep.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\Vm4ENrsiQIGSP.m4a..doc", "hashes": [ { "md5_hash": "0bae79acdbfa8768050dd71671578cd6", "sha1_hash": "e493c273c9500815c8a7cbe630507bc38e30b639", "sha256_hash": "b3aa9d9dfd8b5b072e3b35068e58a2853b4fa93d2c1797b6bc8567ab1344f63b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\vm4enrsiqigsp.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\9qYbL5jzyJkpK.mp3..doc", "hashes": [ { "md5_hash": "36ec66301c50b899fb4f26e0d6e0096d", "sha1_hash": "307327956ec1124c4a945ad175779eb637d7bd58", "sha256_hash": "6c313dd4858f47d61d0a618aebf65e98c2a06d649ba347f282bce38cbc282f31", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\9qybl5jzyjkpk.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\BOyhfUb.m4a..doc", "hashes": [ { "md5_hash": "fcc60f00f0c916574574f596403c98a2", "sha1_hash": "07666e5cb6475230aef594bb9c3993a3d0117471", "sha256_hash": "387ed2ea2731052e631ef943a0d609ad3b346a1865fe6a877131db0bc91ed1c3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\boyhfub.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\cM_EMR.mp3..doc", "hashes": [ { "md5_hash": "da1f34ad32348d864a69f3f26fd74705", "sha1_hash": "cc5a7e3f8c17d2a7dacd3624d82b40ac2f894ac9", "sha256_hash": "f145082df5097586bb5dd25e14a361d621d77bd14c4e174c7e5bb8c99aa39f8e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\cm_emr.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\mZVj-71FZcsC6I.m4a..doc", "hashes": [ { "md5_hash": "f68b9e595fa1d2cfe074d3329b315ecd", "sha1_hash": "04de33073d4f6bd653be579c0d3a019b28d3296d", "sha256_hash": "3bf2e46f349980e193421664cf4d4accfe28c49e48ef596653ef89fc868b9da6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\mzvj-71fzcsc6i.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\sJWeRqq.wav..doc", "hashes": [ { "md5_hash": "14d4489a821158afbfa5116dc33aae69", "sha1_hash": "7349f59264588f812d16dc0e2397b085c93f9325", "sha256_hash": "dfda495f4b70c219bee2b8b857e1c9e64e45908b33cc5fb6d709119151b986c1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\sjwerqq.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\wRa9F7\\HQhOnEbZZq6Vve\\Tnvqh.wav..doc", "hashes": [ { "md5_hash": "c63fb19280568181cd7e597a7a843798", "sha1_hash": "9ee6383f3e92cd745049320943b92e561e6b8d7a", "sha256_hash": "cae05315fcc1cdc50661b05daff39e3747ab024a6781abf2243405faf1a100aa", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\tnvqh.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Links\\desktop.ini..doc", "hashes": [ { "md5_hash": "2dd61f65d7d549f0564ae374b7bdc10d", "sha1_hash": "a7d6c597f67bedbce0b7d4843a274574e9f14ebe", "sha256_hash": "4a5b08ec17f9054b0cbb823f51431fc0ee45bcd530e1ede13945052efce215af", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Links\\Desktop.lnk..doc", "hashes": [ { "md5_hash": "3effda9243388de22d1e73b186f14b2f", "sha1_hash": "78a35bb209ef9c18c5ece7ab4a5ad5781af10778", "sha256_hash": "7bec962c747e54009967b6bd6455e40f6829ffa9a22ceccce2ba579de2653e83", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\desktop.lnk..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Links\\Downloads.lnk..doc", "hashes": [ { "md5_hash": "e46c1d25aa5c77c12544f777a3ad0719", "sha1_hash": "4ad79b7925cafafd4a800e09153f86bedbfbe8a4", "sha256_hash": "453a1c16eb3ae9f01e75204f4b3083732bd08300dc300d82c639ab28d2489c9a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\downloads.lnk..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Links\\OneDrive.lnk..doc", "hashes": [ { "md5_hash": "ac1a60a4a24598311023a14e20d6bbc2", "sha1_hash": "16c74278447505ba6d7f7015a7eb983f813f4c9a", "sha256_hash": "a19711d62c877ad3ad615a4fb309515593f5bb480949debdf070a8dd1158a4b2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\onedrive.lnk..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Bing.url..doc", "hashes": [ { "md5_hash": "c502ca9fdbec3f60dc8b4a0f8c82f0c3", "sha1_hash": "407b56722ef60f05c5edd7297278b223320f836e", "sha256_hash": "e3b8f17d1280c97b6e041d95854da3772509c5a9883d7a9f1bcf3acc8bb279c9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\bing.url..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Favorites\\desktop.ini..doc", "hashes": [ { "md5_hash": "8e72f402d6f32a2eb8b40ef2bf09d134", "sha1_hash": "4997f213a0a8f74565d3d4a6411ee74ed5d370d5", "sha256_hash": "4f7b953408cc9936a382ff90102cbc50db2625cab0d8d017a81caa4b8132ecb5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\desktop.ini..doc", "hashes": [ { "md5_hash": "e4dd0769eed2ff53c7a6d53383848aec", "sha1_hash": "ab6991ca91766ffa6a1c1c85d373eb2ba58b687c", "sha256_hash": "72a735d2fd20e5eb2909a8a433c0e3155452df4ea83b7c9dc43775144053c7b5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\links\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe..doc", "hashes": [ { "md5_hash": "d799fa9f1655f95dc9be3bd1830e630c", "sha1_hash": "a2efedfc9abdf934a0703583b1e602843e2ad95d", "sha256_hash": "a997604d3eba8e39c9f26b46448adcf9ca5ec53fcafb6328a733acaa3f069bf3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\chromesetup.exe..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini..doc", "hashes": [ { "md5_hash": "a366561c12c6f69711d3bb85e052fa7d", "sha1_hash": "c70b3c04a93e561b4cf463ac44d10923da75566f", "sha256_hash": "b1422698d4c21483ab1bd86344784727cad570b0b0b1eeaef1f221496e685910", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe..doc", "hashes": [ { "md5_hash": "74d7fac20609cfe929862a5b95dd43ba", "sha1_hash": "fc15665973703bc952db494bde33bb27c2da45f9", "sha256_hash": "b5d48def2860405b1a3e1ab188403156baf95856e15ffdbcfd30bd5813cd476c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\jre-8u131-windows-x64.exe..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\5lFe4Lx.pptx..doc", "hashes": [ { "md5_hash": "8ae6ba7e2cef64e1b83d905ef8a359d1", "sha1_hash": "3e0290cf998e9438a8fdc1d728853baf249855d5", "sha256_hash": "3319a6208bce5f2ffb77ced09c10b7f946b6ca496ebc1f1ca383d1da45309173", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\5lfe4lx.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\atcbUa--7pS9_Ex5YF.xlsx..doc", "hashes": [ { "md5_hash": "bb2b28d3d9425e23ace84a09fac7df48", "sha1_hash": "fe0682c1a4d8d9f3a4e42ba6b9cbc3d8fc5e3d81", "sha256_hash": "128d71c93597a29a31d5c6e0b34302de049a6b8946013e5a8eaf11dc0ebd6159", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\atcbua--7ps9_ex5yf.xlsx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\blBTLlE6nvl7Pn1.ots..doc", "hashes": [ { "md5_hash": "e0ca48aa6b416a728272cb8532669d77", "sha1_hash": "179cf3e5b3ff62e80bfa8e04da3cbbfb36008987", "sha256_hash": "a205e4456ed8fc355a9c921561d0ba86572f7b2a97b437f56d28bb09fdcc1cdd", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\blbtlle6nvl7pn1.ots..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini..doc", "hashes": [ { "md5_hash": "7132d3a594fda47d039273bbc40dbffd", "sha1_hash": "860a7d33a834d69fcc947226d561d6ca7c1440bb", "sha256_hash": "b9b2bd048b7ee2b23a488b39c36a49d1a453087428ae56f7f43624b1658624bc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\EM9gXmq2LKv8ZfRa.docx..doc", "hashes": [ { "md5_hash": "d6c0aecc35c6752044fc0a3f358c4438", "sha1_hash": "9f7f60ae8a6b76f239c49538aa2861b54decd2e8", "sha256_hash": "629221550960a4923ccad59511006ceacc33207ff3ae1ad3a325b5b7491d1a7d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\em9gxmq2lkv8zfra.docx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\iHZCO2.pptx..doc", "hashes": [ { "md5_hash": "38829e481348405ceb8c56ea6afafcbc", "sha1_hash": "39927f5aa90216eb773e0c6e75e302b758a972b8", "sha256_hash": "adaa6d74ea28423855e6e7692b6e3f8e017d8a8e927b9ac2a1267bf01db3f422", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ihzco2.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\J0-1VW5m.xlsx..doc", "hashes": [ { "md5_hash": "bb3004b11d168b4a36362ab8dac001e3", "sha1_hash": "875b442fdc757c1aa6aeb27a313e6fc39057745b", "sha256_hash": "928ba3e229fb49221ffc5776bef2dbeef69868e8e47cbdbd142a06ac1e622b66", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\j0-1vw5m.xlsx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\K3DCzA0ZGH0l2.pptx..doc", "hashes": [ { "md5_hash": "bdd35099b5733ef0f88a0ef16d548022", "sha1_hash": "5adbfab896b3022888b98fc88fba17090f2f3711", "sha256_hash": "aa91542cbf44a112c3ca34b229643b425702ac2fd7e393f38673b258ee01b17c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\k3dcza0zgh0l2.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\KFqf_.docx..doc", "hashes": [ { "md5_hash": "f62e0d8e2121eba5a7eba2c4295d5119", "sha1_hash": "e05607a0e937a02d31306827ad5146115f0c08f1", "sha256_hash": "18395014b6110b19aa83fd46ebfcb68071f3b217135cce3a1369cb17e980845a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\kfqf_.docx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\lMdzhF4zVS-.pps..doc", "hashes": [ { "md5_hash": "c313df2430b95bccf035b45e8b914d7c", "sha1_hash": "06a99fd7f41b10a48adeeab576bdb8f600b3f26c", "sha256_hash": "ab9a7e09e71451e51982810687069d152bc87cdf15a878a0f3e2bf715cd22491", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\lmdzhf4zvs-.pps..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\m_9eSbnarKHeuqXe.docx..doc", "hashes": [ { "md5_hash": "271ee1a8f66413cc5cbdc13ee9a38eb3", "sha1_hash": "b0ac972721872d2bdad0d08c5c42987ad6c54d5e", "sha256_hash": "0007103666a7d2d5ad561fe7672a402e3057fdc335683721e9d41cc2c8f4d703", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\m_9esbnarkheuqxe.docx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\n3KedfT.pptx..doc", "hashes": [ { "md5_hash": "4e89acc7705a2c247531cfb38cc959ad", "sha1_hash": "364294d210db5d175c90bccc29115097075c7810", "sha256_hash": "654f3b03bb659e77075ec644c0550db81dfe36b8c5b5dac184ac1aaff79b7468", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\n3kedft.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\OeV eLnpiBhWXEtbc4x.doc..doc", "hashes": [ { "md5_hash": "43a109cbad2a998a80bb3859c38d63e5", "sha1_hash": "20e6954a2f3b7b21ccdd95abfba6253d4962ca80", "sha256_hash": "97831cd49259321394e24360862bef0b4ed701f8f68bf17eaa16311fa28e0046", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\oev elnpibhwxetbc4x.doc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\oX bq4vkxJPJqad.xlsx..doc", "hashes": [ { "md5_hash": "2adb27e44099ee6d25e57e76a8a47620", "sha1_hash": "16b0110bfec3748471ff0a9af02bc1e3feaa945a", "sha256_hash": "7c8c94ea900cb780b1e86f4f4c98123563be7ab7fdcdf3ba44917a1cf7df82e0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ox bq4vkxjpjqad.xlsx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\t ZQSDpu2iUJxLE-.pptx..doc", "hashes": [ { "md5_hash": "f4a581445f7aa9a08a908eb3435d3bc1", "sha1_hash": "2125df9acfb366e05b4eac0df7544885b45e2055", "sha256_hash": "3e65b92de3ec19e33ba27854b4d525590f0783787d100e075a46fd0fe903584c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\t zqsdpu2iujxle-.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\T-K5SGwmJ3 mPB9Ky.pps..doc", "hashes": [ { "md5_hash": "5ed82021669a29cfaff651ff2eb994b7", "sha1_hash": "7d84cd164ca658ec1ffa8e0076a05e0d90834840", "sha256_hash": "f399c4c10846ff3acee01c2f1245171d52644c60e3d36288fb23c194a4290c56", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\t-k5sgwmj3 mpb9ky.pps..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\UTm7Gxl.docx..doc", "hashes": [ { "md5_hash": "c5f37bb31bf82d434c4f160447302c2f", "sha1_hash": "2f34d66c058d9695961bdff0b84bbe82f08a04d1", "sha256_hash": "73f5a5be792c8bc6482290898c5650bb8b919d016a0d77c1fb8825e6a179805f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\utm7gxl.docx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\UwnMvSU.xlsx..doc", "hashes": [ { "md5_hash": "0aadbe0252995e204ad2923b0f16f804", "sha1_hash": "c13664a4c2005697da822c62e112cbdf606be53c", "sha256_hash": "c255a6b0b9b59d2ee5ba0049086a146cbb803feaa1ebb19c0da0c4d768d3e355", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\uwnmvsu.xlsx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\v5i14i.docx..doc", "hashes": [ { "md5_hash": "3cde757e4ac9b478f2008278635e5fa0", "sha1_hash": "b3504351bcf95644560fb6e085fe6daec668d7af", "sha256_hash": "9e3dbf4855f172b589e18a4199a4453238f4ca2a24e57c2ea3259b8eb5c3dc43", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\v5i14i.docx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\VCAVi.xlsx..doc", "hashes": [ { "md5_hash": "6238bb78be1339b9b84d1d7269bc154e", "sha1_hash": "801fdc717f4d616a34639ed2c53c6304313d39ce", "sha256_hash": "5f57480f45195ff6f9b47fe359af826bbf874a773dc501c9680dea69016e1f3a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\vcavi.xlsx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\xCi5Tni.rtf..doc", "hashes": [ { "md5_hash": "0bde91f0221a2b4ad9a3b70bde3b8210", "sha1_hash": "4bfe1825d7b1d75e7cdc9806eabd5e4b392b72ac", "sha256_hash": "007070b5fc331849f1bd6e0a7db59103032bcd88b605469deaeb78da74cadc04", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\xci5tni.rtf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\ZyRASY.xlsx..doc", "hashes": [ { "md5_hash": "fef54df67c6fdf75b7060d5f49e2b8d3", "sha1_hash": "e0a22e6515fff108263aec290c8f0c0eca772fdb", "sha256_hash": "29843e2e80655534d29fb410f4a68e457e872d90f7b0ecb57869cb4581a3b89a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\zyrasy.xlsx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\1oYB.pptx..doc", "hashes": [ { "md5_hash": "c9a73b53db9df683fd0ccddd73677e5c", "sha1_hash": "da0d71891879f9d1119585929f6a3e70d89cf327", "sha256_hash": "989136495493a8503b90b7bcabc84485d3bf28223aa3cbb0d8b21a124af376c2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\1oyb.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\5Fs 9 UvPA.doc..doc", "hashes": [ { "md5_hash": "80a43a0cd95e74917ab9b95c595aa51d", "sha1_hash": "f15fa83391c035ed7147af2d644933297b423dba", "sha256_hash": "898e7ae080088de473abc7489ae11cbd154c1ab65299c331e5053cd0bbbfeb06", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\5fs 9 uvpa.doc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\L1EP-E2O7byfuic0.csv..doc", "hashes": [ { "md5_hash": "eddf88a74f8c1e38e81b2d39d0fb7287", "sha1_hash": "768dd32ba36737944d5ace6bfb5af83707c56eab", "sha256_hash": "40898d186753f8d7e6023c96570a22e1444f1a124f762f4c07ca2aa64b928e99", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\l1ep-e2o7byfuic0.csv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\qF 8oXk89NL1YrK6.rtf..doc", "hashes": [ { "md5_hash": "05a2747411805d61007a585241022ba1", "sha1_hash": "585383376b2364edc3995107f438512f3884efca", "sha256_hash": "6c3129a81a26f0d276a764ed3c7fbaace8ce847eded077b8516803c60e66052f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\qf 8oxk89nl1yrk6.rtf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\18WQhA51.odp..doc", "hashes": [ { "md5_hash": "ed686da5f988824371258451d3ddb018", "sha1_hash": "00704182211c992a1248d141d56478cafa7132ff", "sha256_hash": "019368379f17cc4936c49d82ce42e559cd289d8c6510f3da1543e20244290801", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\18wqha51.odp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\D91N0Zq.odp..doc", "hashes": [ { "md5_hash": "c44fb790a903e179e9e7e99ab84bc1e8", "sha1_hash": "6b9c157cb058922272eb22c3c5602c1d94785b56", "sha256_hash": "aea9d1b73f8f83a8f2bb9c909c6033078ec0b5c189622f19df8d03ae341538e5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\d91n0zq.odp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\sNyJwDMYDf6NcUAOQLTL.xls..doc", "hashes": [ { "md5_hash": "b2f5778eaa82936b9880b13b6cc13da3", "sha1_hash": "8a6973f5df8e4150a945138e774d8d12fbfc681f", "sha256_hash": "c733222b99882a60e133f39aef7cbef6374e93533ad12ef791f6dc558db83185", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\snyjwdmydf6ncuaoqltl.xls..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\WRYiECXnl.ods..doc", "hashes": [ { "md5_hash": "45eaac4bc88b05e200b38b08360ac8fa", "sha1_hash": "21907f66018c1e00fbdeae8dbbbe08e8312e1128", "sha256_hash": "7e32f2864e64a33eb337e4bca656e4b81d6115d7e3984cf1cf70a78cb007c786", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\wryiecxnl.ods..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\xCTUW.xlsx..doc", "hashes": [ { "md5_hash": "a099b07894d23f259de01bcd81532ab3", "sha1_hash": "35aeab669ec14f35f86cc273f380a4b618822039", "sha256_hash": "a638b3b671899fc0c2a422c3f662045bdaaf1269138b1b16ffe4dad39a6eba8a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\xctuw.xlsx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Xie6INIoLR04EDGFFG.odp..doc", "hashes": [ { "md5_hash": "ce5622667042406ce58a90565531f08b", "sha1_hash": "72322e6a97eca15e148203c98b50e7d095a37f12", "sha256_hash": "60d63174500f7fab9f0922dc5f2a82091e05ee312f4d75e5aabffa5ad2640f80", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\xie6iniolr04edgffg.odp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\kFMszdL4nvSI2cz.docx..doc", "hashes": [ { "md5_hash": "5139f918139be5599211e4c712f07bdd", "sha1_hash": "2cce857577dcaa1d2fdae120468c3eb588ebd3c8", "sha256_hash": "5b4d1b02dae55d427fd7ecd2cb5df99d767fe36058c6b567e33994088a3ef535", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\kfmszdl4nvsi2cz.docx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\wGY2YQxdKU.pdf..doc", "hashes": [ { "md5_hash": "326f7cbebd98a3b18f99a43a7db7b05a", "sha1_hash": "4c3768d54fb47063f1c1755c70088160d0e244d9", "sha256_hash": "7f71b00cb45357d55d27f6d2b94aebfdfce3f35dee287a8adcddb17c5ffa02b8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\wgy2yqxdku.pdf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\wi8F0Q5O.xls..doc", "hashes": [ { "md5_hash": "d5997333bcd42432169bfcaee29512f0", "sha1_hash": "9f4a43f439980be525e48c9fbff55fc7edabc093", "sha256_hash": "bb2fe0b0822c2002b2ce57819b375c0f52cd68d7979d002272f227af7ae8b6dd", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\wi8f0q5o.xls..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\X5ifFEMYR.odp..doc", "hashes": [ { "md5_hash": "9de86a69a5cc92864320d842ac329aaf", "sha1_hash": "5b29d9da543911b9f24bd5d241b1d8c9a9bd80fa", "sha256_hash": "ef0c4f7b3790b7af48fb54d9c088e8ad78ffff7a37de5d6deb49ec19b589016a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\x5iffemyr.odp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\Xy sr4g.pptx..doc", "hashes": [ { "md5_hash": "128767fe14a9907085fd57f6c937cfc0", "sha1_hash": "1df958b17a5b9763fb698187cafec716ab9b1d79", "sha256_hash": "134129fe83705338601df589940d84ae9218a1a75fc2d0c578408ae9748acf64", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\xy sr4g.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\Y1x8ZqxCi645D\\yB mn0zdV.pptx..doc", "hashes": [ { "md5_hash": "b2749671c660f1646c5037ec51a8bf90", "sha1_hash": "92ca8270f596b9429482882370e3c4253fe257eb", "sha256_hash": "7e14be90109155ea24e755540485f426e893954710baf6285b5eef9e63d992aa", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\yb mn0zdv.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\5WalP3Bl2rWl-yo.xls..doc", "hashes": [ { "md5_hash": "d53936a9eec3f561e3ebfa9c778c4334", "sha1_hash": "c1fb7eafa9413c5aa69d844b7892796f8dd0b842", "sha256_hash": "3bf122ad6abeb26c19b9333ce3411ba51ef96d24d141e8128a338de4056f0377", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\5walp3bl2rwl-yo.xls..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\oIDz6LcGNvXGF5.csv..doc", "hashes": [ { "md5_hash": "955e310b305a7e8202364c651d7e75b8", "sha1_hash": "40ba7d618b16398d69675848db8f3c9e374096d8", "sha256_hash": "e2a8916d0118c0fd8d54cedd715ab3af840515aad7a60473574cde18de86d475", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\oidz6lcgnvxgf5.csv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\oPt7hCN-3pA.xls..doc", "hashes": [ { "md5_hash": "3e51be8ba7c141dd85be275ce5cccbc3", "sha1_hash": "1a6c72464834014a881501cd2dbc1f20e346a240", "sha256_hash": "13ffcb9e9f4301353a8f50af6bf4af1778c1a07562de78044a4cc394802c10e5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\opt7hcn-3pa.xls..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\PsMh09Ma0h6Sf.ots..doc", "hashes": [ { "md5_hash": "aeb0d0c152fd93185711103144ab979e", "sha1_hash": "4d59939d7abe3f0b9accde8a972a1dd8f7f9aa0e", "sha256_hash": "8a2ecaea0995acdefa73abf55121aa89cd6fde12362cda4928e57169714ec8fe", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\psmh09ma0h6sf.ots..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\st0nFHr7kLd7u.doc..doc", "hashes": [ { "md5_hash": "41d2932154f84eaf3cab87bf7a31cfcb", "sha1_hash": "f232156e9c35549d716910003fb608ba57e44ed2", "sha256_hash": "ccb1380350d1cf11b606f4fad048837386749aec598121b9710c4c3b2840568f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\st0nfhr7kld7u.doc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\Ud56yevTC_MGVYoy1e.pptx..doc", "hashes": [ { "md5_hash": "f32acbff1d55d75ff859ac340b6514be", "sha1_hash": "62a2d45b559f9b7a60926a8a99f5633e12c48081", "sha256_hash": "a5cac3c6ff0c64690a3b2239090494e30083a5b42f838f22f8390f38e6727e2b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\ud56yevtc_mgvyoy1e.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\VATb.csv..doc", "hashes": [ { "md5_hash": "55c6a2205364cf393b393ce3fe80297c", "sha1_hash": "6d0056a644b354efae9424f01dab3fa33355f9ab", "sha256_hash": "1e53ab22d9ffb9afb5d3fc4935107c830caf2129bd7141be820c982e2e09ad8d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\vatb.csv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\yfDWeHYmEqVC.rtf..doc", "hashes": [ { "md5_hash": "e4ca725480de99538747656fb243f6a0", "sha1_hash": "40d49f0e6ae4a03c3e8f31d5505cf786932996a8", "sha256_hash": "68e7cd45719d00a84ec4845337ab3f9fcfcec5386664c0d2426d907061bb53ca", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\yfdwehymeqvc.rtf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\WcaMW\\3qzJcOg3A.ods..doc", "hashes": [ { "md5_hash": "ed3f754e5eca0ffa477f9b6e2ed592f9", "sha1_hash": "54c390f584ef73b4f678bee834c8ccea0bb1dbea", "sha256_hash": "799f2ab2e477efd4b00f4a8c932f2f3d7ef50c86ed5a5f7a5750f3c5ad9d1b2c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\wcamw\\3qzjcog3a.ods..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\TtwPs\\PKpwIdD38h0\\4Ldoz2W50h\\WcaMW\\hfvups2InA_-BDQV8.rtf..doc", "hashes": [ { "md5_hash": "c0ccae55766c814555f970daad435d74", "sha1_hash": "2510608c7e28d38e78465b8c4a48d886b2ae3482", "sha256_hash": "e2ba19b9bb407881b43899599adb1368bae5d8f7f748fc95c14196731a0bde1d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\wcamw\\hfvups2ina_-bdqv8.rtf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst..doc", "hashes": [ { "md5_hash": "1e22fc77e5bc9612f67bf185dfc04a15", "sha1_hash": "5790d282e5fd089b445970b5715e31f15667ad03", "sha256_hash": "05179a8e28d115d9421190660a0216a83e68ea9f1c07cade8af59e39d4194a65", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2..doc", "hashes": [ { "md5_hash": "9aa8a9f23804a3ec80fa871475dbfbdb", "sha1_hash": "7f9ead291dd9cb8ee524c82c4e30c3ae15d829b7", "sha256_hash": "77b4c0d5077e25a7a3704e7f90b30af7bc246962689b4730457875e3ddcd0973", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one..doc", "hashes": [ { "md5_hash": "a41e1e20c8bde5fea292e8b65d41986f", "sha1_hash": "d7617d18bc4c5dfc5e3aa2e8d8261bbe0d756134", "sha256_hash": "5c7795ed04090e95cd8e455955db8738e4a2124bbc17544de863e0899051698d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini..doc", "hashes": [ { "md5_hash": "b7ba30f52e6052a678f9b39e7f965d17", "sha1_hash": "f8efb0bfbdbc55f85ac8c41a76888c1ffcb833c7", "sha256_hash": "4fb0d86f57dc9ce54ad774b2f8d42292f226f3af462a56b2a8ad6bb0dd670c53", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico..doc", "hashes": [ { "md5_hash": "41c4d389a921cbb64521e10a5078c10c", "sha1_hash": "5cfba21a4bc52a1fc56b8ce92cd554861da3aaa1", "sha256_hash": "1a8c01876d88f34dbbe6d6594057c12893ef188f4cc1066f17876d3096639495", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\2xnCn\\GRkI.docx..doc", "hashes": [ { "md5_hash": "1b0174959cdf1c95e7302f7f642aab37", "sha1_hash": "8326e7835c750b9f5db47e5d2a22f2b050e8a85b", "sha256_hash": "62aae11d86e50f8dbcaf9093247519aa18272dafdadefc36b8d3d505bf7e27d8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\grki.docx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\2xnCn\\Kt33N_.ppt..doc", "hashes": [ { "md5_hash": "85052940c01ef0d3c9c27f50d59a6baa", "sha1_hash": "443ce008650116e5f5b2e46405f9012112a7d464", "sha256_hash": "0d9ccdc0d2312b2fdd4acd1ab28f1d539aa6a799eb470984fb4c494d62fae004", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\kt33n_.ppt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\2xnCn\\uCq2JjZ35.xlsx..doc", "hashes": [ { "md5_hash": "e0ad9b054b207ded2770a5b538452a0f", "sha1_hash": "bb17fdf10902f89c0e50402243b81c5725f9f202", "sha256_hash": "67199ddf4dbd100f8a710b2ca6a95eb7fbca95e9bdbc37a8431bf3e34d71b3d3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\ucq2jjz35.xlsx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\2xnCn\\vVBl5CzqCzhTO.pptx..doc", "hashes": [ { "md5_hash": "4eaad822e259b13761f077f604889d85", "sha1_hash": "1c0d13aac0f75b3bb076003af17e3d0d056bf25c", "sha256_hash": "d2a6a09d8be9a40d4256ef12a37ffe01f5979ab403d6464058a38a4388e371be", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\vvbl5czqczhto.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\1IlkJYRGg.ots..doc", "hashes": [ { "md5_hash": "1696b50b454109c22f7c62c0714fbb92", "sha1_hash": "7152dfea0d70b3bc0aae98d0117878b3bfb4e189", "sha256_hash": "a762cb70e2691cca2658d174de64f6c2188bc17fe2a3fe7e1e989606aa5b17d5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\1ilkjyrgg.ots..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\23i5acjUYsPml.m4a..doc", "hashes": [ { "md5_hash": "1049d6cfe5fcc37f7e557a255cec377d", "sha1_hash": "3625354724d3a06c839371ed15d5f8af54be7078", "sha256_hash": "790f1d58144a7dc5b4d191b921fcee9bc029dfaf79a368f6fcd7e3950982414d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\23i5acjuyspml.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\34vihcjptwSY126cU6r.jpg..doc", "hashes": [ { "md5_hash": "1a8c1766f2707c2f0973a80b3531f419", "sha1_hash": "39d8ad9b912c520658a91b194d6ce7ccaf7b937c", "sha256_hash": "05b299956ca9ed1ccad20469151cde9c1e811cdaef4d01ac71f8e0fc830e885a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\34vihcjptwsy126cu6r.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5AYMmPlf.mp3..doc", "hashes": [ { "md5_hash": "0aadc6941fef5e387cee1db92622d22e", "sha1_hash": "8422a1e0d87c962ea7138611920d7218bb68e29a", "sha256_hash": "9e6a6d4489b2489ff45ac6c29993382955159ed43c4ebf69f5fc00632376c183", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\5aymmplf.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7UeLr6 ahNxhpqMpU.flv..doc", "hashes": [ { "md5_hash": "28ba4169da6d69a97930ba2edd8c6ef2", "sha1_hash": "010b5042c14e40944d38329a95fe24793bbe3989", "sha256_hash": "29fc657349085667f690d1aa6b761fe060ff1765abc96f66f9e6e65bab12b1e1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\7uelr6 ahnxhpqmpu.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\9j9hSV0AGjQ5P.mp4..doc", "hashes": [ { "md5_hash": "0a88f39f142d19070c62bb3853c9fb88", "sha1_hash": "18dec2ee645b8558ff53f9a56a80d60b06d62fb2", "sha256_hash": "dd478094357324673e879840eb21a008ee218b69107c7c097d4621f4a96e5506", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\9j9hsv0agjq5p.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aF0cJNiJiaE7zPu.swf..doc", "hashes": [ { "md5_hash": "263e21ad09c330f8518cc491c7000f95", "sha1_hash": "bbcf9e81f3a1ab303224edd160f1fe05682cbeb5", "sha256_hash": "d7426fd57e5734570dd1a6b424bdb25827ac84f0fe8376784a6ff877a90a13d6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\af0cjnijiae7zpu.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\BwjEJ4q.gif..doc", "hashes": [ { "md5_hash": "7413754f9c6e16e9dfc044f6de3b6823", "sha1_hash": "5edba77834febc437f81c74a3d27ad01633153be", "sha256_hash": "ffc5b02b3b793cb97fa3ed455c0faf5829231dc62b3a284055ad53544ee19868", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\bwjej4q.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\cfrs5lie-afnL_qf.jpg..doc", "hashes": [ { "md5_hash": "bb7a682d9063e54fbc7c03db7a99ff4f", "sha1_hash": "0b8d12fcd3c43aed1253a41eb901d2ae794be112", "sha256_hash": "c4805b3ab365557436f3cafafe18685652e5849cd7f4f18a145f84b42d894087", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cfrs5lie-afnl_qf.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\cp_i6VwPEAGUcDb9VyN0.pdf..doc", "hashes": [ { "md5_hash": "5cfbabe8dde1f2fd154410b802dd7b34", "sha1_hash": "ced769de411494a779b2b2343cd9f4b79680e3a9", "sha256_hash": "93999ffd16aafbc136d3e430b5bec7fc0a67f521b0bd5ae4ef00e6317d28f56e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cp_i6vwpeagucdb9vyn0.pdf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\cR1v23Mrj a0X.m4a..doc", "hashes": [ { "md5_hash": "353e22f480804d868ba20aa5ac199d8b", "sha1_hash": "06e8d8c2ffba635b70c747c95c456e3cadf25f62", "sha256_hash": "667d72304a80383477cc66d3cd1415043e689a10be09a88a652e2ab78b14f6c2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cr1v23mrj a0x.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini..doc", "hashes": [ { "md5_hash": "1303831f18dffd4cf7f31ee7c7682dc9", "sha1_hash": "af7733df345ddf40bce6ff8799b0ebbfd06c2e62", "sha256_hash": "032970cd060cdf8c701de88534b813f7b69277ce8ae5be1f12f8363b387bcfe7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Dm CHu2si-01iRgc2.pps..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\dm chu2si-01irgc2.pps..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\eWhS_.mp3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\ewhs_.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MSC000000981631.vbs..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\msc000000981631.vbs..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\O1hl.flv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\o1hl.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OfmyPUTg.wav..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\ofmyputg.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\phaPdn7U89EhKuLZIB.gif..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\phapdn7u89ehkulzib.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Qgj3gqt4NmSeH.avi..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\qgj3gqt4nmseh.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\QPcuvsBPfyJdsjj0R.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\qpcuvsbpfyjdsjj0r.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\quymqFwIVsq34Nza18mw.mp3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\quymqfwivsq34nza18mw.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rqqQHXhU2jy2mu2PyuI.jpg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\rqqqhxhu2jy2mu2pyui.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\sf42hT3t.flv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\sf42ht3t.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\W9fVdr5L65XR8o.avi..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\w9fvdr5l65xr8o.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xCEXvXhj0VQdjnT3.jpg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\xcexvxhj0vqdjnt3.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z8 bc8_xQU.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\z8 bc8_xqu.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Z82HPIHYz D.flv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\z82hpihyz d.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZyLZN4wKBOnt edaUa.avi..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\zylzn4wkbont edaua.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Zbtp57yuqYSnW07xS\\IprKUQN5V.flv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\zbtp57yuqysnw07xs\\iprkuqn5v.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Zbtp57yuqYSnW07xS\\JJwbkuO44n.gif..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\zbtp57yuqysnw07xs\\jjwbkuo44n.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Zbtp57yuqYSnW07xS\\vBNDk.ppt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\zbtp57yuqysnw07xs\\vbndk.ppt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\9jTu8T4KEHg5MRd.xls..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\9jtu8t4kehg5mrd.xls..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\QLOJTsq6N0t9Kt4SxCxw.jpg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\qlojtsq6n0t9kt4sxcxw.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Z-Bho7uk1tOcQIpb.swf..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\z-bho7uk1tocqipb.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\zbnK-TfEBdN8Xe.m4a..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\zbnk-tfebdn8xe.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\1b 3uKDjMA.rtf..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\1b 3ukdjma.rtf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\cvvEUY6.flv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\cvveuy6.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\eu1jcB_.gif..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\eu1jcb_.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\LRm18Lj3x1fX2IJ.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\lrm18lj3x1fx2ij.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\n5Ztp\\Kup5hojDWdyFrOpXF\\lsRwPHc.odp..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\n5ztp\\kup5hojdwdyfropxf\\lsrwphc.odp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\aclviho asldjfl.contact..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\asdlfk poopvy.contact..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\chucu jadnvk.contact..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\desktop.ini..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\desktop.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\lulcit amkdfe.contact..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\sikvnb huvuib.contact..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2A7x9EPcCAgl.ppt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2a7x9epccagl.ppt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\AmZ3.jpg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\amz3.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dgkF.bmp..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dgkf.bmp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\e4fZOADVmOZQm.mkv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\e4fzoadvmozqm.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\etLaCzOa2X6.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\etlaczoa2x6.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\F5nHzYdQA07MgBbF.wav..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\f5nhzydqa07mgbbf.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\gD34Cv9-IHgCunUMAE.wav..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\gd34cv9-ihgcunumae.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\H0OF8ATjoMI2aUXO4m.mp4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\h0of8atjomi2auxo4m.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\h0_3DUVl2w52PWKJiRk.ods..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\h0_3duvl2w52pwkjirk.ods..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\hxh5o9rz4Edu-fPev.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hxh5o9rz4edu-fpev.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IEa0O.bmp..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\iea0o.bmp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\K0j6F-xlIeLiy.mp4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\k0j6f-xlieliy.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\KvZ2MG9pJ.avi..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\kvz2mg9pj.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LnELOxkuzwomT.mp3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lneloxkuzwomt.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\oJq0bw.mp4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ojq0bw.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\OuO0Z.pps..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ouo0z.pps..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r8UCd.flv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\r8ucd.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rF9cz5H_X40G5jLH.mkv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rf9cz5h_x40g5jlh.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SpDa.csv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\spda.csv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SVMzi08.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\svmzi08.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\t7rM-lmeZ.m4a..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\t7rm-lmez.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UjkY.xlsx..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ujky.xlsx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\w7lhDIvk.mp3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\w7lhdivk.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\W9JHrRgo LbXIOiPY7w.doc..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\w9jhrrgo lbxioipy7w.doc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WL sWzcfAqsxCr.gif..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\wl swzcfaqsxcr.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XFr9Wzy.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xfr9wzy.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XjJL2fLOy8LCZl1A4u8.wav..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xjjl2floy8lczl1a4u8.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xrIFO.mkv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xrifo.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yt58.mkv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yt58.mkv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ZEXa.wav..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\zexa.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\skype\\roottools\\roottools.conf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\addons.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-addons.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-gfx.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-plugins.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist.xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cert8.db..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\compatibility.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\containers.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\content-prefs.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cookies.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\formhistory.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\key3.db..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\kinto.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\mimeTypes.rdf..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\mimetypes.rdf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\permissions.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\places.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\pluginreg.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\prefs.js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\revocations.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\search.json.mozlz4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\search.json.mozlz4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\secmod.db..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessioncheckpoints.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore.js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sitesecurityservicestate.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\times.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\times.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\webappsstore.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\webappsstore.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\xulstore.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\xulstore.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore-backups\\previous.js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\license.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\session-state.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\state.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\store.json.mozlz4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\crashes\\store.json.mozlz4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kl0o5i+exwq3txuldkmf9w==.jsonlz4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170518000419..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20170518000419..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\addressbook.acrodata..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globdata..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globsettings..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\adobe\\acrobat\\dc\\readermessages..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb.chk..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB00004.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb00004.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDBres00001.jrs..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edbres00001.jrs..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDBres00002.jrs..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edbres00002.jrs..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edbtmp.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\0g-mX7JTJe-Sj10.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\0g-mx7jtje-sj10.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\2U0LE_l1ov.wav..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\2u0le_l1ov.wav..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\3--oMmPwZ.avi..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\3--ommpwz.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\3vZH2yjtYsKfc7y.bmp..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\3vzh2yjtyskfc7y.bmp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\3Zhtv.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\3zhtv.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\47QMQ.jpg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\47qmq.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\65Orwx5ceqv.mp3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\65orwx5ceqv.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\6fNW.csv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\6fnw.csv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\8gXW1Z6dvIk.bmp..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\8gxw1z6dvik.bmp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\9GKFDLC9zdG9VdStxiB.gif..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\9gkfdlc9zdg9vdstxib.gif..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\ArmUI.ini..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\armui.ini..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\FW6lt2NDjZH.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\fw6lt2ndjzh.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\F_4Tu8ppFN_dR.m4a..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\f_4tu8ppfn_dr.m4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\g7wBDP8D.mp3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\g7wbdp8d.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\iDZnhlbh_ G-e45.mp4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\idznhlbh_ g-e45.mp4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\klAR_8_n.swf..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\klar_8_n.swf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\LHNIWSJ-20171110-1726.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\lhniwsj-20171110-1726.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\lUDWozZeb1O57be4N4p.avi..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\ludwozzeb1o57be4n4p.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\NNRGrFwXihuC8WV.mp3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nnrgrfwxihuc8wv.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\oFv5oNAG.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\ofv5onag.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\rav5pCmmACXHU.mp3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\rav5pcmmacxhu.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\rVpdrW_orZM9.bmp..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\rvpdrw_orzm9.bmp..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\sU6SVcwb41LxR.mp3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\su6svcwb41lxr.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\VfH6K03Dt2b6cL.mp3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\vfh6k03dt2b6cl.mp3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\W8nb..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\w8nb..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\y-deNk8MyPH4JZrn4.pptx..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\y-denk8myph4jzrn4.pptx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\yEvVo0n.csv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\yevvo0n.csv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\_TyC_.flv..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\_tyc_.flv..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\nsmA14E.tmp\\System.dll..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nsma14e.tmp\\system.dll..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{241d7c96-f8bf-4f85-b01f-e2b043341a4b}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{241d7c96-f8bf-4f85-b01f-e2b043341a4b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{33C56305-BA7B-48E0-9784-2D05E3F5D27E}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{33c56305-ba7b-48e0-9784-2d05e3f5d27e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{728047C0-00D2-4FDB-A069-06338B92E93B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{728047c0-00d2-4fdb-a069-06338b92e93b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{7940ACF8-60BA-4213-A7C3-F3B400EE266D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{7940acf8-60ba-4213-a7c3-f3b400ee266d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{A88F43D0-B9C8-42F2-B9F3-90902FC0B22B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{a88f43d0-b9c8-42f2-b9f3-90902fc0b22b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{E2E2F6CF-9D1A-4004-8999-8AB81010B5AC}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{e2e2f6cf-9d1a-4004-8999-8ab81010b5ac}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Proxy_Automatic_Config_Group.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_proxy_automatic_config_group.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsChangeAccountPicture.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingschangeaccountpicture.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupAppSizesList.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupappsizeslist.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupAutoplayDefaults.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupautoplaydefaults.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupDataSenseMainPageOverview.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupdatasensemainpageoverview.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupDataSenseMainPageSettings.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupdatasensemainpagesettings.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessFilterKeys.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessfilterkeys.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessNarrator.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessnarrator.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessOSK.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessosk.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessOther.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessother.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessStickyKeys.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessstickykeys.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessToggleKeys.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccesstogglekeys.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupFamilyUsers.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupfamilyusers.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupInputMouse.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupinputmouse.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupLockScreenPreview.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouplockscreenpreview.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupMapsUpdates.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupmapsupdates.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupNotificationsAppList.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupnotificationsapplist.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemDeviceEncryption.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemdeviceencryption.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemSupportInfo.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemsupportinfo.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemWindowsInfo.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemwindowsinfo.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPen.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppen.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPersonalizeColorChoose.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppersonalizecolorchoose.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPicturePassword.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppicturepassword.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepDisplayOff.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepdisplayoff.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepDisplayOffAoAc.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepdisplayoffaoac.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepSleep.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepsleep.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPrivacyLocationHistory.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupprivacylocationhistory.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupRegionDateTimeFormats.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupregiondatetimeformats.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupSpeechMicrophone.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupspeechmicrophone.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupVirtualDesktops.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupvirtualdesktops.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupYourAccount.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupyouraccount.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsManage.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountsmanage.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsPicture.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountspicture.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsSync.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountssync.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsUsers.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountsusers.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageActivate.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageactivate.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaults.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaults.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaultsFileExtensionView.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaultsfileextensionview.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaultsProtocolView.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaultsprotocolview.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsNotifications.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsnotifications.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageBackground.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagebackground.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageBatterySaver.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagebatterysaver.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageColors.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagecolors.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDataSenseOverview.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedatasenseoverview.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDevicesPen.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedevicespen.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDevicesPrinters.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedevicesprinters.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessClosedCaptioning.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessclosedcaptioning.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessHighContrast.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccesshighcontrast.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessKeyboard.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccesskeyboard.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMagnifier.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmagnifier.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMoreOptions.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmoreoptions.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMouse.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmouse.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessNarrator.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessnarrator.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageLockScreen-2.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagelockscreen-2.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageLockScreen.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagelockscreen.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageMaps.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagemaps.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageMultiTasking.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagemultitasking.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkAirplaneMode.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkairplanemode.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkDialup.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkdialup.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkDirectAccess.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkdirectaccess.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkEthernet.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkethernet.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkMobileBroadband.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkmobilebroadband.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkMobileHotspot.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkmobilehotspot.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkProxy.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkproxy.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkVPN.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkvpn.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkWiFi.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkwifi.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkWorkplace.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkworkplace.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemAutoPlay.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemautoplay.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemBluetooth.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystembluetooth.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDevices.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdevices.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDeviceSettings.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdevicesettings.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDisplay.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdisplay.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemInfo.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsysteminfo.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemShellMode.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemshellmode.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyAccountInfo.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacyaccountinfo.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCalendar.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycalendar.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyContacts.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycontacts.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCustomPeripherals.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycustomperipherals.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyGeneral.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacygeneral.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyLocation.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacylocation.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMessaging.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymessaging.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMicrophone.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymicrophone.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMotionData.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymotiondata.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyPersonalization.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacypersonalization.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyRadios.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacyradios.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacySIUFSettings.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacysiufsettings.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyWebcam.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacywebcam.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreDeveloperOptions.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoredeveloperoptions.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreMusUpdate.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoremusupdate.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreOneBackup.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoreonebackup.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreRestore.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestorerestore.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageScreenPowerAndSleep.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagescreenpowerandsleep.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageSpeech.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagespeech.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStart.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestart.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStorageSenseSaveLocations.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestoragesensesavelocations.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStorageSenseStorageOverview.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestoragesensestorageoverview.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageThemes.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagethemes.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionDateTime.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregiondatetime.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionLanguage.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregionlanguage.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionSpelling.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregionspelling.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageWindowsDefender.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagewindowsdefender.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageWindowsServerDefender.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagewindowsserverdefender.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Settings_DeveloperModeGroup.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settings_developermodegroup.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Settings_DeviceDiscoveryGroup.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settings_devicediscoverygroup.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_CursorThickness.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_cursorthickness.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsAnimationsEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_isanimationsenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsMouseKeysEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_ismousekeysenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsOverlappedContentEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_isoverlappedcontentenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsAutoStartEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isautostartenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsFollowInsertPointEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isfollowinsertpointenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsFollowKeyFocusEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isfollowkeyfocusenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsInversionColorEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isinversioncolorenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_MouseCursorColor.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_mousecursorcolor.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_MouseCursorSize.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_mousecursorsize.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsAutoStartEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isautostartenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsDuckAudioEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isduckaudioenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEchoCharacterEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isechocharacterenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEchoWordEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isechowordenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsFastKeyEntryEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isfastkeyentryenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsFollowInsertionEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isfollowinsertionenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsHighlightCursorEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_ishighlightcursorenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsPlayAudioCuesEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isplayaudiocuesenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsReadHintsEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isreadhintsenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechPitch.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechpitch.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechSpeed.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechspeed.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechVoices.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechvoices.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_NotificationDuration.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_notificationduration.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Autoplay_IsEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_autoplay_isenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_OverrideControl.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_overridecontrol.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink-2.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_settingslink-2.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_settingslink.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink-2.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_usagedetailslink-2.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_usagedetailslink.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DataSense_ConfigureSetLimitButton.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datasense_configuresetlimitbutton.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_CountryRegion.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_countryregion.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsAutomaticDSTAdjustEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_isautomaticdstadjustenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsTimeSetAutomaticallyEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_istimesetautomaticallyenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_Set.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_set.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_SetFormats.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_setformats.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_TimezoneInfo.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_timezoneinfo.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Audio.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_audio.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Browser.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_browser.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Calendar.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_calendar.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Email.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_email.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Map.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_map.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Photos.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_photos.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Video.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_video.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_EnablePixie.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_enablepixie.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_EnableRipple.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_enableripple.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_SetHandedness.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_sethandedness.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Device_Add.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_device_add.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_AdvancedSettings.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_advancedsettings.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_DPI_Override.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_dpi_override.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Duplicate.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_duplicate.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IdentifyDetectWireless.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_identifydetectwireless.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IsAutoBrightnessEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_isautobrightnessenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IsRotationLocked.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_isrotationlocked.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_MainMonitor.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_mainmonitor.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Monitors.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_monitors.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Orientation.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_orientation.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Mouse_SetButtonConfiguration.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_mouse_setbuttonconfiguration.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Mouse_SetScrollPage.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_mouse_setscrollpage.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_CursorSpeed.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_cursorspeed.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableEdgeGesture.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enableedgegesture.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableTouchPad.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enabletouchpad.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableVisualFeedback.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enablevisualfeedback.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableVisualFeedbackPM.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enablevisualfeedbackpm.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_FourFingerTapEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_fourfingertapenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_LeaveOnWithMouse.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_leaveonwithmouse.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_PanEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_panenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_RightClickZoneEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_rightclickzoneenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_SetActivationTimeout.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_setactivationtimeout.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_SetScrollDirection.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_setscrolldirection.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_TapAndDrag.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_tapanddrag.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_TapsEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_tapsenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_ThreeFingerSlideEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_threefingerslideenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_ThreeFingerTapEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_threefingertapenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_TwoFingerTapEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_twofingertapenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_ZoomEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_zoomenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsAutoCorrectionEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_isautocorrectionenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsAutoShiftEngageEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_isautoshiftengageenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsCompatibilityKeyboardEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_iscompatibilitykeyboardenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsDoubleTapSpaceEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_isdoubletapspaceenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsKeyAudioFeedbackEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_iskeyaudiofeedbackenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsPredictionSpaceInsertionEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_ispredictionspaceinsertionenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsShiftLockEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_isshiftlockenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsSpellcheckingEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_isspellcheckingenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsTextPredictionEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_keyboard_istextpredictionenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Add_Profile.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_language_add_profile.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Installed_Profiles_Collection.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_language_installed_profiles_collection.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Personal_Data_Control.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_language_personal_data_control.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Web_Content_Control.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_language_web_content_control.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Maps_DeleteAll.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_maps_deleteall.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Maps_Download_Add_Package.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_maps_download_add_package.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_ResetYourPC.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_misc_resetyourpc.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_PreviewBuild.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_misc_rollbackyourpc_previewbuild.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_Windows7.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_misc_rollbackyourpc_windows7.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_Windows8.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_misc_rollbackyourpc_windows8.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_Windows8_1.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_misc_rollbackyourpc_windows8_1.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MultiTasking_AeroSnapEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_multitasking_aerosnapenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MultiTasking_SnapAssistEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_multitasking_snapassistenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MultiTasking_SnapFillEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_multitasking_snapfillenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MusUpdate_AdvancedSettingsLink.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_musupdate_advancedsettingslink.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MusUpdate_UpdateActionButton.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_musupdate_updateactionbutton.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_PinnedQuickActions.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_notifications_pinnedquickactions.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_SelectIconsToAppearOnTaskbar.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_notifications_selecticonstoappearontaskbar.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_ShowAppNotifications.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_notifications_showappnotifications.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_SoftLandingEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_notifications_softlandingenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_SystemIcons.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_notifications_systemicons.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_ActivateWindowsLicense.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_activatewindowslicense.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_GetPCName.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_getpcname.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_InstalledRamStatus.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_installedramstatus.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_JoinCloudDomain.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_joinclouddomain.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_JoinDomain.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_joindomain.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_LeaveOrganization.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_leaveorganization.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_PenAndTouchStatus.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_penandtouchstatus.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_ProcessorStatus.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_processorstatus.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_ProductIdStatus.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_productidstatus.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_RenamePC.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_renamepc.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_SystemTypeStatus.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_pcsystem_systemtypestatus.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Background_ChooseBackground.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_background_choosebackground.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Background_ChooseFit.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_background_choosefit.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Color_ColorPrevalence.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_color_colorprevalence.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Color_EnableTransparency.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_color_enabletransparency.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenAppsBadge.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_lockscreenappsbadge.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenAppsTile.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_lockscreenappstile.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenBackground.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_lockscreenbackground.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenChooseBackgroundType.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_lockscreenchoosebackgroundtype.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenSlideshowSource_CloudBrandName.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_personalize_lockscreenslideshowsource_cloudbrandname.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutAC.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_displayofftimeoutac.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutAC_AoAc.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_displayofftimeoutac_aoac.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutDC.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_displayofftimeoutdc.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutDC_AoAc.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_displayofftimeoutdc_aoac.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_SleepTimeoutAC.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_sleeptimeoutac.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_SleepTimeoutDC.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_powerandsleep_sleeptimeoutdc.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Privacy_AdvertisingIdEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_privacy_advertisingidenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Privacy_EnableCollectionOfUrlsAppsUse.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_privacy_enablecollectionofurlsappsuse.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Privacy_OpenPrivacyStatementLink.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_privacy_openprivacystatementlink.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Proxy_AutomaticConfigScript.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_proxy_automaticconfigscript.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Proxy_AutomaticDetection.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_proxy_automaticdetection.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Proxy_ManualProxyAddress.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_proxy_manualproxyaddress.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Radio_DeviceList.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_radio_devicelist.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Radio_IsAirplaneModeEnabled.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_radio_isairplanemodeenabled.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_ModeChangeConfig.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_shellmode_modechangeconfig.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_Preference.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_shellmode_preference.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_TaskbarAppsVisibility.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_shellmode_taskbarappsvisibility.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_Toggle.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_shellmode_toggle.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Startup_AdvancedStartup.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_startup_advancedstartup.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_LinkToPlacesPage.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_linktoplacespage.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_ShowRecentlyAddedAppsGroup.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_showrecentlyaddedappsgroup.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_ShowSuggestedAppsGroup.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_showsuggestedappsgroup.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_Size.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_size.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_StoreMFUApps.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_storemfuapps.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_StoreRecentlyOpenedItems.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_start_storerecentlyopeneditems.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_StorageSense_AppSizesOptionalComponentsLink-2.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_storagesense_appsizesoptionalcomponentslink-2.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_StorageSense_AppSizesOptionalComponentsLink-3.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_storagesense_appsizesoptionalcomponentslink-3.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_StorageSense_AppSizesOptionalComponentsLink.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_storagesense_appsizesoptionalcomponentslink.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncAccessibility_Toggle.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_syncaccessibility_toggle.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncBrowserSettings_Toggle.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_syncbrowsersettings_toggle.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncCredentials_Toggle.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_synccredentials_toggle.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncLanguage_Toggle.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_synclanguage_toggle.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncMaster_Toggle.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_syncmaster_toggle.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncPersonalization_Toggle.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_syncpersonalization_toggle.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_Windows_Toggle.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_syncsettings_windows_toggle.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_AssignedAccess.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_assignedaccess.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_ChangePassword.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_changepassword.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_DelayLock.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_delaylock.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_EnrollmentFace.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_enrollmentface.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_EnrollmentFingerprint.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_enrollmentfingerprint.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_EnrollmentIris.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_enrollmentiris.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PicturePassword.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_picturepassword.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PINPassword.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_pinpassword.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_SingleSignOnAccountList.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_singlesignonaccountlist.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_AltTabFilter.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_virtualdesktops_alttabfilter.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_TaskbarFilter.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_virtualdesktops_taskbarfilter.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_CorpDeviceManagement.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_workplace_corpdevicemanagement.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_RelatedSettings.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_workplace_relatedsettings.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AddOrRemovePrograms.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\addorremoveprograms.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0042AE00-17CC-42EC-B5AD-B8F08A025D71}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0042ae00-17cc-42ec-b5ad-b8f08a025d71}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{01ACC6BC-9A3D-49c5-AC7D-0FB9E026C424}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{01acc6bc-9a3d-49c5-ac7d-0fb9e026c424}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{028DE9F5-65F3-4A06-A048-421056F3E421}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{028de9f5-65f3-4a06-a048-421056f3e421}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{030C20F0-E20B-417A-B7AD-CEC6EE955CD3}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{030c20f0-e20b-417a-b7ad-cec6ee955cd3}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{059ECE57-19D1-4112-B05C-86F8ED5DA6B0}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{059ece57-19d1-4112-b05c-86f8ed5da6b0}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06628900-13DD-4fc3-A18B-0E9CE7B663ED}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06628900-13dd-4fc3-a18b-0e9ce7b663ed}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06D12455-F35D-44D6-8E00-3F6A360CC030}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06d12455-f35d-44d6-8e00-3f6a360cc030}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06FF5AE9-8F7C-41AD-B71B-62137DE26715}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06ff5ae9-8f7c-41ad-b71b-62137de26715}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{082594D9-8481-43F0-AE8F-62EA920A4220}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{082594d9-8481-43f0-ae8f-62ea920a4220}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{083D5202-600A-4f38-981B-2D138FBDC4D1}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{083d5202-600a-4f38-981b-2d138fbdc4d1}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08D48377-1C06-416D-B382-61E8D5F6CD18}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{08d48377-1c06-416d-b382-61e8d5f6cd18}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08EB53B7-3384-473A-8D2C-6C0E71F3BF34}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{08eb53b7-3384-473a-8d2c-6c0e71f3bf34}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0CDC534D-A9FF-450D-91D8-96C341ED44AA}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0cdc534d-a9ff-450d-91d8-96c341ed44aa}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0DF721FA-F921-4416-A491-1924F212C705}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0df721fa-f921-4416-a491-1924f212c705}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0F1B68F6-B72D-4229-BC9C-A87F0B16B17B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0f1b68f6-b72d-4229-bc9c-a87f0b16b17b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1011988D-12F9-446b-85FF-A1579CCD1678}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1011988d-12f9-446b-85ff-a1579ccd1678}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11135AE0-7372-4f85-8D1B-93D6EFBE5A99}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{11135ae0-7372-4f85-8d1b-93d6efbe5a99}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11E71674-7556-4E27-8D59-03B2FA846204}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{11e71674-7556-4e27-8d59-03b2fa846204}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{12BBBD91-8E16-4C3F-9715-16E5C8299244}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{12bbbd91-8e16-4c3f-9715-16e5c8299244}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{141D98AD-3E07-4C44-A578-4DCA078286A4}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{141d98ad-3e07-4c44-a578-4dca078286a4}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{14DEC75C-D6CE-44A9-8349-AD0F46EF96BE}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{14dec75c-d6ce-44a9-8349-ad0f46ef96be}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1515BA81-68EB-4143-A29F-51A40A65DAE6}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1515ba81-68eb-4143-a29f-51a40a65dae6}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{16C327FA-D8A8-41C0-B022-64AC67715327}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{16c327fa-d8a8-41c0-b022-64ac67715327}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\nsm8BD5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsm8bd5.tmp", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\nsx8BC5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsx8bc5.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\nss8BF6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nss8bf6.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\nss8BF6.tmp\\System.dll", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nss8bf6.tmp\\system.dll", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\nss8BF6.tmp\\System.dll", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nss8bf6.tmp\\system.dll", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{17cd9488-1228-4b2f-88ce-4298e93e0966}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{17cd9488-1228-4b2f-88ce-4298e93e0966}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1845AA13-3644-4FBC-B766-EEEF29683256}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1845aa13-3644-4fbc-b766-eeef29683256}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1928DA28-C5A7-4F13-AF81-8238D57A793F}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1928da28-c5a7-4f13-af81-8238d57a793f}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1a4635ec-181d-45ae-b691-bc75bec02756}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1a4635ec-181d-45ae-b691-bc75bec02756}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1A5712E4-AAD7-4717-B22A-CF0B8438E2E6}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1a5712e4-aad7-4717-b22a-cf0b8438e2e6}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1BDB99DF-3832-49D6-9AE0-52105DB568DA}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1bdb99df-3832-49d6-9ae0-52105db568da}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1DD03EE3-FC46-456A-8632-B0717A9D497D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1dd03ee3-fc46-456a-8632-b0717a9d497d}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{201CEF4B-7444-4B2F-B885-5E8F0AA1D614}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{201cef4b-7444-4b2f-b885-5e8f0aa1d614}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{207D6BD2-A09B-406f-8A72-BC90C49FC152}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{207d6bd2-a09b-406f-8a72-bc90c49fc152}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{21A5437E-D266-4F56-A146-06744A8BC071}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{21a5437e-d266-4f56-a146-06744a8bc071}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{232A1851-808C-4B44-A92A-38E862989CE5}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{232a1851-808c-4b44-a92a-38e862989ce5}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{29B87534-19A8-4A39-AA81-2148E7DE5894}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{29b87534-19a8-4a39-aa81-2148e7de5894}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{2B6FE85A-C7AA-440F-B9A3-3F5EDCA3F6C2}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{2b6fe85a-c7aa-440f-b9a3-3f5edca3f6c2}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{2D06D17B-2A5F-4835-AF30-6D2D58A4A66C}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{2d06d17b-2a5f-4835-af30-6d2d58a4a66c}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{30137454-0E1F-43bb-9CB8-AEF452964B0B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{30137454-0e1f-43bb-9cb8-aef452964b0b}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{31DD3DA1-ED44-4BA8-A67B-6EA93DEA77E7}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{31dd3da1-ed44-4ba8-a67b-6ea93dea77e7}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{33843DB0-24E7-4682-A019-5393D7F2BFFA}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{33843db0-24e7-4682-a019-5393d7f2bffa}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{33F1F9B5-BD94-4D77-96AE-62F10E4A010A}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{33f1f9b5-bd94-4d77-96ae-62f10e4a010a}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{36C8B34B-83F9-4704-B817-9AB1A723705A}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{36c8b34b-83f9-4704-b817-9ab1a723705a}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{36fb1658-3a23-4d62-9bfd-37f4b18a85e9}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{36fb1658-3a23-4d62-9bfd-37f4b18a85e9}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{37092408-D49C-451D-B56D-78B243DC475C}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{37092408-d49c-451d-b56d-78b243dc475c}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{37C361D8-51CD-40fa-A797-8FC1EA28F9F4}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{37c361d8-51cd-40fa-a797-8fc1ea28f9f4}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{37E2F32E-C821-4094-B429-2B4E8EA810AA}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{37e2f32e-c821-4094-b429-2b4e8ea810aa}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{38bd6d6e-bf78-4c31-b05a-7447ee37669f}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{38bd6d6e-bf78-4c31-b05a-7447ee37669f}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3911D4F8-AD61-4911-A151-5682C26A7427}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{3911d4f8-ad61-4911-a151-5682c26a7427}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3A100872-EC27-46A5-BBCC-92C90635AE3B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{3a100872-ec27-46a5-bbcc-92c90635ae3b}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3A4140C8-50D3-44E9-BF50-C878204DE0F5}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{3a4140c8-50d3-44e9-bf50-c878204de0f5}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3F0AD6DB-3246-48E4-ACD7-696FF62AE68D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{3f0ad6db-3246-48e4-acd7-696ff62ae68d}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4026492f-2f69-46b8-b9bf-5654fc07e423}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{4026492f-2f69-46b8-b9bf-5654fc07e423}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{40419485-c444-4567-851a-2dd7bfa1684d}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{40419485-c444-4567-851a-2dd7bfa1684d}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{420C524A-2A76-43F7-B1B2-C3CF736557C7}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{420c524a-2a76-43f7-b1b2-c3cf736557c7}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4228F99D-227F-4058-9EA3-BB2B616D7444}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{4228f99d-227f-4058-9ea3-bb2b616d7444}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{45FDB5DF-1457-4A41-A824-7AD9C75767BC}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{45fdb5df-1457-4a41-a824-7ad9c75767bc}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{46E84184-51CC-4A7B-A40A-6D3E86D402DE}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{46e84184-51cc-4a7b-a40a-6d3e86d402de}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4A2F952E-0618-467F-ADC5-FEBB66AEB82F}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{4a2f952e-0618-467f-adc5-febb66aeb82f}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4BCD16D0-BA72-4F0D-88F9-50D912BFA2B2}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{4bcd16d0-ba72-4f0d-88f9-50d912bfa2b2}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4F9B0706-0A8F-45B0-BFA6-C66CD45246D7}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{4f9b0706-0a8f-45b0-bfa6-c66cd45246d7}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{50DF4F13-4188-49C3-B2FB-A76404DC0ACF}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{50df4f13-4188-49c3-b2fb-a76404dc0acf}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5163E94E-4C07-420B-B173-320232B8AFB7}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5163e94e-4c07-420b-b173-320232b8afb7}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{53440D79-CD2D-4013-B192-D478AE882E53}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{53440d79-cd2d-4013-b192-d478ae882e53}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{54692DB7-FC98-4D5E-AC15-CC5095FA5669}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{54692db7-fc98-4d5e-ac15-cc5095fa5669}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{54D8069E-E75A-4437-B45B-8EB3B8C97434}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{54d8069e-e75a-4437-b45b-8eb3b8c97434}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5530E8CC-1B9E-4798-A880-BA719ADFBBBD}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5530e8cc-1b9e-4798-a880-ba719adfbbbd}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{55E51B6E-7D17-4C80-859E-3007A1F2B6AA}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{55e51b6e-7d17-4c80-859e-3007a1f2b6aa}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{58e3c745-d971-4081-9034-86e34b30836a}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{58e3c745-d971-4081-9034-86e34b30836a}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5902614C-D9C7-4902-9F7F-BAF85454D0B2}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5902614c-d9c7-4902-9f7f-baf85454d0b2}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5A2C0E5E-5974-4E44-B4C6-AD4C2B6BAF53}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5a2c0e5e-5974-4e44-b4c6-ad4c2b6baf53}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5BB16858-F647-465E-BCFD-010EE9DD41B7}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5bb16858-f647-465e-bcfd-010ee9dd41b7}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5D461B44-2753-4DD7-B2C0-BAB71B1F4C1A}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5d461b44-2753-4dd7-b2c0-bab71b1f4c1a}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5D611F64-7985-459B-BDFF-AEC069CB2625}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5d611f64-7985-459b-bdff-aec069cb2625}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5DD91132-02E8-43F6-88BD-E50B7BE2EF29}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5dd91132-02e8-43f6-88bd-e50b7be2ef29}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5DE5B491-2CEA-4AD9-824A-982A22C0B64E}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5de5b491-2cea-4ad9-824a-982a22c0b64e}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5ea4f148-308c-46d7-98a9-49041b1dd468}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5ea4f148-308c-46d7-98a9-49041b1dd468}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5FFAA809-0961-40CF-90A4-58037867FA50}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5ffaa809-0961-40cf-90a4-58037867fa50}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{60AC7FA0-A928-4D45-B4DD-AC70A6175E67}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{60ac7fa0-a928-4d45-b4dd-ac70a6175e67}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{60C811E8-C857-404E-98BB-EE5D83C1DF5A}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{60c811e8-c857-404e-98bb-ee5d83c1df5a}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{62d8ed13-c9d0-4ce8-a914-47dd628fb1b0}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{62d8ed13-c9d0-4ce8-a914-47dd628fb1b0}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{638f8e21-e157-40d7-97e0-a0c8e4c4e2b5}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{638f8e21-e157-40d7-97e0-a0c8e4c4e2b5}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{63929D0B-AAAC-4DCA-AE8A-222EC37F7A88}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{63929d0b-aaac-4dca-ae8a-222ec37f7a88}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{641102EF-6463-46E9-842D-176013D7ACC8}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{641102ef-6463-46e9-842d-176013d7acc8}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6775CCA4-CC42-44F7-800C-4E94FF1EA8C0}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6775cca4-cc42-44f7-800c-4e94ff1ea8c0}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{67ca7650-96e6-4fdd-bb43-a8e774f73a57}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{67ca7650-96e6-4fdd-bb43-a8e774f73a57}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\classic_{685e7dc2-db57-4ed0-8b6d-5fe44d78d4f0}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{685e7dc2-db57-4ed0-8b6d-5fe44d78d4f0}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{68F4F33C-658C-4278-94C1-22B8E653F3E8}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{68f4f33c-658c-4278-94c1-22b8e653f3e8}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{693E4EF4-9060-469B-AB2E-948B6B68A883}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{693e4ef4-9060-469b-ab2e-948b6b68a883}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{693E4EF5-9060-469B-AB2E-948B6B68A883}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{693e4ef5-9060-469b-ab2e-948b6b68a883}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6A10BC7B-2586-4B57-A5AA-C14BDE743DC4}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6a10bc7b-2586-4b57-a5aa-c14bde743dc4}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6AE88B06-50B2-46B0-93EA-4B5C73D3A0B5}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6ae88b06-50b2-46b0-93ea-4b5c73d3a0b5}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6CA1F1CE-1FED-4D96-A82E-08CEDB139AA3}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6ca1f1ce-1fed-4d96-a82e-08cedb139aa3}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6CBA2898-2EFE-4604-9933-F1F64DAE2A32}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6cba2898-2efe-4604-9933-f1f64dae2a32}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6dfd7c5c-2451-11d3-a299-00c04f8ef6af}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6dfd7c5c-2451-11d3-a299-00c04f8ef6af}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{71D0780F-10D2-459C-983B-94A642161220}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{71d0780f-10d2-459c-983b-94a642161220}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{725be8f7-668e-4c7b-8f90-46bdb0936430}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{725be8f7-668e-4c7b-8f90-46bdb0936430}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{73C9C58C-2E01-4F68-B1B9-7A4DD2EF71F7}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{73c9c58c-2e01-4f68-b1b9-7a4dd2ef71f7}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7429F4F9-AE58-401a-82AD-723F3C6BDDD6}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7429f4f9-ae58-401a-82ad-723f3c6bddd6}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{75AC9145-7EC9-4883-82A7-AD3429020AA0}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{75ac9145-7ec9-4883-82a7-ad3429020aa0}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{76F31A78-3FDA-4F80-B015-95CFD81463AD}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{76f31a78-3fda-4f80-b015-95cfd81463ad}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7a4d0c5d-51ad-443e-87c7-66b757586c56}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7a4d0c5d-51ad-443e-87c7-66b757586c56}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7ABBE8E6-757F-419A-B2E0-07D5694F8E0F}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7abbe8e6-757f-419a-b2e0-07d5694f8e0f}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7B086E4E-366C-454A-85CC-B8B533482B10}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7b086e4e-366c-454a-85cc-b8b533482b10}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7C3E0552-96E2-4069-AC1C-208C146683CA}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7c3e0552-96e2-4069-ac1c-208c146683ca}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7D13A5DB-6081-48BD-8EA3-A9D7FE67A335}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7d13a5db-6081-48bd-8ea3-a9d7fe67a335}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7DE6CF7C-B699-421B-A808-139E798E6C64}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7de6cf7c-b699-421b-a808-139e798e6c64}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7E5BC096-F558-419A-9326-BC6414D592C3}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7e5bc096-f558-419a-9326-bc6414d592c3}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7F8B6C83-2A89-47A0-B334-AA58D042CDEC}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7f8b6c83-2a89-47a0-b334-aa58d042cdec}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8050502B-9B94-408C-BF49-D2D8887C1BCF}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8050502b-9b94-408c-bf49-d2d8887c1bcf}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{80f3f1d5-feca-45f3-bc32-752c152e456e}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{80f3f1d5-feca-45f3-bc32-752c152e456e}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{821FB666-D307-4865-86BB-68725A30999C}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{821fb666-d307-4865-86bb-68725a30999c}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{84C9670E-825D-4128-B173-2963886C5A3E}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{84c9670e-825d-4128-b173-2963886c5a3e}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8562B9B8-812D-420C-9189-DC216D788A49}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8562b9b8-812d-420c-9189-dc216d788a49}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{875FE7D6-5BDF-496F-B349-91E5E3625B86}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{875fe7d6-5bdf-496f-b349-91e5e3625b86}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8774b87d-a2b4-49a0-8237-bfefd00646c2}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8774b87d-a2b4-49a0-8237-bfefd00646c2}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{87842A7E-D784-458d-BEF4-CFDC632DCF3E}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{87842a7e-d784-458d-bef4-cfdc632dcf3e}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{87d66a43-7b11-4a28-9811-c86ee395acf7}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{87d66a43-7b11-4a28-9811-c86ee395acf7}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{886EDAFC-1051-483F-8AE2-904087A7E580}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{886edafc-1051-483f-8ae2-904087a7e580}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{88C9D04D-39DD-41EE-A63B-23218D69717F}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{88c9d04d-39dd-41ee-a63b-23218d69717f}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8902C92D-5AB7-433B-9065-3F55F8334E29}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8902c92d-5ab7-433b-9065-3f55f8334e29}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{895607E0-D0F9-48bd-B19E-96FBE9BBDCF9}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{895607e0-d0f9-48bd-b19e-96fbe9bbdcf9}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{89A2270D-DF2E-4172-8BA5-159D6AD00C15}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{89a2270d-df2e-4172-8ba5-159d6ad00c15}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8bb27ec5-5cb3-4781-baee-3439df4806e4}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8bb27ec5-5cb3-4781-baee-3439df4806e4}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8D58F804-9520-4208-A527-7C2B6CB77B33}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8d58f804-9520-4208-a527-7c2b6cb77b33}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8E0C279D-0BD1-43C3-9EBD-31C3DC5B8A77}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8e0c279d-0bd1-43c3-9ebd-31c3dc5b8a77}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8E21794E-9303-44C5-A493-C3DC53C0E463}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8e21794e-9303-44c5-a493-c3dc53c0e463}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8e908fc9-becc-40f6-915b-f4ca0e70d03d}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8e908fc9-becc-40f6-915b-f4ca0e70d03d}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{906435EC-336D-4B77-BCD6-397DE8318852}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{906435ec-336d-4b77-bcd6-397de8318852}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{907F262A-012A-4F6A-94C9-F479F3E6EE16}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{907f262a-012a-4f6a-94c9-f479f3e6ee16}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{90ab71ce-bab6-4ca2-84fe-629338405756}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{90ab71ce-bab6-4ca2-84fe-629338405756}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{91BA8E01-F854-4418-A108-E63323DDAE60}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{91ba8e01-f854-4418-a108-e63323ddae60}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9389633E-8BCB-4448-93CD-EBFFA0759257}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9389633e-8bcb-4448-93cd-ebffa0759257}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9430DB91-B966-4971-A955-E3DBA1F889E7}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9430db91-b966-4971-a955-e3dba1f889e7}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{944A41B9-C0FD-41AE-A6DF-5AC4FE5A59B4}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{944a41b9-c0fd-41ae-a6df-5ac4fe5a59b4}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{950fd00b-c4a9-4465-852a-b1eb51e2e7f6}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{950fd00b-c4a9-4465-852a-b1eb51e2e7f6}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{955E7FFD-4DD9-4124-96FC-86C3C653DD33}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{955e7ffd-4dd9-4124-96fc-86c3c653dd33}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{96BC4455-FDA3-4DE2-8B71-9D1953F0B32D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{96bc4455-fda3-4de2-8b71-9d1953f0b32d}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{96DF8B78-8299-4BC1-B56B-6C375FBEC228}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{96df8b78-8299-4bc1-b56b-6c375fbec228}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9891D47B-7E37-4265-BAD2-1FA991543B90}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9891d47b-7e37-4265-bad2-1fa991543b90}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{98CCA0B9-CF6C-4FFD-98E1-87BFEDDD4D21}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{98cca0b9-cf6c-4ffd-98e1-87bfeddd4d21}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9B802EF5-59B7-4974-9022-06DC2A9B1677}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9b802ef5-59b7-4974-9022-06dc2a9b1677}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9BA8A9A5-F1C1-4F09-AE9A-EFEAA5961BE3}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9ba8a9a5-f1c1-4f09-ae9a-efeaa5961be3}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9C39057F-5CE5-4BAB-BE61-2957A12EEC52}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9c39057f-5ce5-4bab-be61-2957a12eec52}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9c60de1e-e5fc-40f4-a487-460851a8d915}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9c60de1e-e5fc-40f4-a487-460851a8d915}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}.settingcontent-ms", "operations": [ "read", "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9EF86966-2F35-49BE-A9F6-398E0B844411}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9ef86966-2f35-49be-a9f6-398e0b844411}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9fe63afd-59cf-4419-9775-abcc3849f861}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9fe63afd-59cf-4419-9775-abcc3849f861}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{a0275511-0e86-4eca-97c2-ecd8f1221d08}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a0275511-0e86-4eca-97c2-ecd8f1221d08}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{A10DFF38-B2D2-44AC-952B-A2B5DC5D0C9F}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a10dff38-b2d2-44ac-952b-a2b5dc5d0c9f}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{a3dd4f92-658a-410f-84fd-6fbbbef2fffe}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a3dd4f92-658a-410f-84fd-6fbbbef2fffe}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{A42E8D99-83E6-4D12-B403-F46059D02CF0}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a42e8d99-83e6-4d12-b403-f46059d02cf0}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{A7160DE5-E591-4D98-9BB0-0CAC99D5F2D5}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a7160de5-e591-4d98-9bb0-0cac99d5f2d5}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{A73DCDB5-E233-4FC2-8083-6E431939002A}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a73dcdb5-e233-4fc2-8083-6e431939002a}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{a8a91a66-3a7d-4424-8d24-04e180695c7a}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a8a91a66-3a7d-4424-8d24-04e180695c7a}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AA9D2032-E8FB-4f8c-99C9-09F539AEBD59}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{aa9d2032-e8fb-4f8c-99c9-09f539aebd59}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AACA901F-E74F-4894-B074-F55059532853}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{aaca901f-e74f-4894-b074-f55059532853}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AAF384A9-978C-41B6-B394-0C40C2EAAA4B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{aaf384a9-978c-41b6-b394-0c40c2eaaa4b}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ABB4509D-9043-4EF2-8796-E4646ECF951D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{abb4509d-9043-4ef2-8796-e4646ecf951d}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AF3BA0EC-B240-401E-B4EE-3E89F275205B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{af3ba0ec-b240-401e-b4ee-3e89f275205b}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B0B4886C-4B31-4824-ADCD-0DAF5C8BAFF6}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b0b4886c-4b31-4824-adcd-0daf5c8baff6}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B1207959-FFBF-4417-A6B1-4BF0EDA51F5A}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b1207959-ffbf-4417-a6b1-4bf0eda51f5a}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B123B0AB-2E4E-4325-804A-32F99784DA0B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b123b0ab-2e4e-4325-804a-32f99784da0b}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B1FE5142-DEDD-409B-BCC8-547EC08DE84E}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b1fe5142-dedd-409b-bcc8-547ec08de84e}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{b2c761c6-29bc-4f19-9251-e6195265baf1}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b2c761c6-29bc-4f19-9251-e6195265baf1}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B3C577FA-7C51-4259-A1C4-088BD0B0932E}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b3c577fa-7c51-4259-a1c4-088bd0b0932e}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B6B2793F-F4B9-49FD-B578-212C3C020892}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b6b2793f-f4b9-49fd-b578-212c3c020892}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B7622F10-9A47-4BF2-B6EF-2C20B4510254}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b7622f10-9a47-4bf2-b6ef-2c20b4510254}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B896819B-CF73-4da0-8F59-6E744A6BCD5F}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b896819b-cf73-4da0-8f59-6e744a6bcd5f}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B935C3B6-969C-4FC2-B96C-7F06794471AF}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b935c3b6-969c-4fc2-b96c-7f06794471af}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B98AD935-426A-482B-9383-ED7D8BB99A6F}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b98ad935-426a-482b-9383-ed7d8bb99a6f}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{BABB24A6-0242-4AE5-BD83-C5816526F63D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{babb24a6-0242-4ae5-bd83-c5816526f63d}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bb06c0e4-d293-4f75-8a90-cb05b6477eee}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bb06c0e4-d293-4f75-8a90-cb05b6477eee}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bb64f8a7-bee7-4e1a-ab8d-7d8273f7fdb6}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bb64f8a7-bee7-4e1a-ab8d-7d8273f7fdb6}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{BD256B65-94BE-4194-84BF-41D50D0EF26E}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bd256b65-94be-4194-84bf-41d50d0ef26e}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bd84b380-8ca2-1069-ab1d-08000948f534}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bd84b380-8ca2-1069-ab1d-08000948f534}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{be122a0e-4503-11da-8bde-f66bad1e3f3a}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{be122a0e-4503-11da-8bde-f66bad1e3f3a}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{BEC9E135-14C1-4e00-B5C8-899F26833A5A}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bec9e135-14c1-4e00-b5c8-899f26833a5a}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bf782cc9-5a52-4a17-806c-2a894ffeeac5}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bf782cc9-5a52-4a17-806c-2a894ffeeac5}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C16A18A2-DC4F-4B7D-92F1-14C430AD17DC}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c16a18a2-dc4f-4b7d-92f1-14c430ad17dc}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C3915CF9-A3D9-4EFD-B209-62C05793EE0F}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c3915cf9-a3d9-4efd-b209-62c05793ee0f}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C3F521C1-249F-48FD-9D9D-731EA4568776}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c3f521c1-249f-48fd-9d9d-731ea4568776}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C5361E07-6AA3-4453-81BC-93E8F85EABED}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c5361e07-6aa3-4453-81bc-93e8f85eabed}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{c555438b-3c23-4769-a71f-b6d3d9b6053a}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c555438b-3c23-4769-a71f-b6d3d9b6053a}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{c58c4893-3be0-4b45-abb5-a63e4b8c8651}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c58c4893-3be0-4b45-abb5-a63e4b8c8651}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C5AE651D-D027-4D11-8125-595B9933C78B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c5ae651d-d027-4d11-8125-595b9933c78b}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C7C81DAD-835C-45B0-9632-60F3EB5D55AC}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c7c81dad-835c-45b0-9632-60f3eb5d55ac}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C86B1923-8E1F-414B-83DB-94B09BA73E15}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c86b1923-8e1f-414b-83db-94b09ba73e15}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CD2A5953-36A2-427D-B762-3610F37A5D89}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{cd2a5953-36a2-427d-b762-3610f37a5d89}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CD95D0E3-6B3A-495B-9FDA-57FAD586304D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{cd95d0e3-6b3a-495b-9fda-57fad586304d}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CE4F7091-EEC0-400E-A019-38503D525293}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ce4f7091-eec0-400e-a019-38503d525293}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CF081448-68EC-4969-9F8B-BB23B329B712}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{cf081448-68ec-4969-9f8b-bb23b329b712}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d17d1d6d-cc3f-4815-8fe3-607e7d5d10b3}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d17d1d6d-cc3f-4815-8fe3-607e7d5d10b3}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D1AF7F5F-18C1-4143-81E5-EDAF02255883}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d1af7f5f-18c1-4143-81e5-edaf02255883}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d20ea4e1-3957-11d2-a40b-0c5020524153}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d20ea4e1-3957-11d2-a40b-0c5020524153}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D4690CFE-6A59-4BAB-BFF7-9ED0D083E798}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d4690cfe-6a59-4bab-bff7-9ed0d083e798}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d555645e-d4f8-4c29-a827-d93c859c4f2a}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d555645e-d4f8-4c29-a827-d93c859c4f2a}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D5BAC999-E706-4311-9DB0-86E117B1FD25}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d5bac999-e706-4311-9db0-86e117b1fd25}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D5D5B38A-0FD8-43B6-8C7D-372D84BD357D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d5d5b38a-0fd8-43b6-8c7d-372d84bd357d}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D652F9E4-08FD-4A24-8EAC-05715188233E}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d652f9e4-08fd-4a24-8eac-05715188233e}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D679D992-D843-4D3C-BFEA-5EDF4D37EE9F}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d679d992-d843-4d3c-bfea-5edf4d37ee9f}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D825FEC7-DA3D-456A-BEF2-20F07BA0449E}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d825fec7-da3d-456a-bef2-20f07ba0449e}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D995F7E9-727D-4AD6-83F3-A4A753965A8F}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d995f7e9-727d-4ad6-83f3-a4a753965a8f}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d9ef8727-cac2-4e60-809e-86f80a666c91}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d9ef8727-cac2-4e60-809e-86f80a666c91}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{da9f1e02-aa94-40bf-b3cd-030231a10acc}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{da9f1e02-aa94-40bf-b3cd-030231a10acc}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DAF32862-EF3D-4D61-AB92-47AEB51DDC80}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{daf32862-ef3d-4d61-ab92-47aeb51ddc80}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DD338333-7000-45CC-A84D-64680D6E683D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{dd338333-7000-45cc-a84d-64680d6e683d}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DDF23EF5-6677-42C1-92CB-29BDCB7375B8}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ddf23ef5-6677-42c1-92cb-29bdcb7375b8}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DF7B19EF-DEA5-47D7-BBA5-9FCBE400A59D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{df7b19ef-dea5-47d7-bba5-9fcbe400a59d}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E00117F3-53BA-4E06-B9BF-B8E22A1469E6}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e00117f3-53ba-4e06-b9bf-b8e22a1469e6}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E07F215A-6022-40E0-A109-17078992E5F9}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e07f215a-6022-40e0-a109-17078992e5f9}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E2394C16-F45A-496F-83CC-49E163281662}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e2394c16-f45a-496f-83cc-49e163281662}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{e2e7934b-dce5-43c4-9576-7fe4f75e7480}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e2e7934b-dce5-43c4-9576-7fe4f75e7480}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E4B554C8-B067-4540-A478-0565BB1F76B9}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e4b554c8-b067-4540-a478-0565bb1f76b9}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E6243488-3449-4D4D-98AA-FFC14E3FF0F8}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e6243488-3449-4d4d-98aa-ffc14e3ff0f8}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E79BCB1B-EEB7-4180-98FD-BD47F6DCFF79}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e79bcb1b-eeb7-4180-98fd-bd47f6dcff79}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{e9950154-c418-419e-a90a-20c5287ae24b}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e9950154-c418-419e-a90a-20c5287ae24b}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E9C71548-B580-43B2-ACDB-1BA924002754}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e9c71548-b580-43b2-acdb-1ba924002754}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EBEC2956-F512-474D-8631-9E753CC40653}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ebec2956-f512-474d-8631-9e753cc40653}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ecdb0924-4208-451e-8ee0-373c0956de16}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ecdb0924-4208-451e-8ee0-373c0956de16}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ED0FF627-BFD1-4F68-9A74-974E73F41A3A}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ed0ff627-bfd1-4f68-9a74-974e73f41a3a}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ed834ed6-4b5a-4bfe-8f11-a626dcb6a921}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ed834ed6-4b5a-4bfe-8f11-a626dcb6a921}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EE423D17-7ED8-4B33-9555-C23DEEAFB4B6}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ee423d17-7ed8-4b33-9555-c23deeafb4b6}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EE439E7E-CE1E-4ABE-9EA8-50F12ED01FE0}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ee439e7e-ce1e-4abe-9ea8-50f12ed01fe0}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EF462183-352B-4DCF-811C-07FA7CFCD5AC}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ef462183-352b-4dcf-811c-07fa7cfcd5ac}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EF8F379B-747B-4C8E-B3D1-4A29E6CF45AE}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ef8f379b-747b-4c8e-b3d1-4a29e6cf45ae}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EFACECBA-BCCD-468B-BAB3-7CA40A898982}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{efacecba-bccd-468b-bab3-7ca40a898982}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F025B6FD-D1CA-4a32-9BEB-DBEF1D2F6926}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f025b6fd-d1ca-4a32-9beb-dbef1d2f6926}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F0E02D62-6C1D-4eb3-AC47-F8401425C6BC}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f0e02d62-6c1d-4eb3-ac47-f8401425c6bc}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F120B10E-C882-4613-955F-B4DF13C6E803}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f120b10e-c882-4613-955f-b4df13c6e803}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f2ddfc82-8f12-4cdd-b7dc-d4fe1425aa4d}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f2ddfc82-8f12-4cdd-b7dc-d4fe1425aa4d}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F2E71049-6F88-4A3B-9475-5A2B40B36092}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f2e71049-6f88-4a3b-9475-5a2b40b36092}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F3FD1F8E-B34A-49AE-95B9-5DBEAB5BFB49}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f3fd1f8e-b34a-49ae-95b9-5dbeab5bfb49}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f56fbb39-e6d9-4b6d-9c29-ae82cff2925f}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f56fbb39-e6d9-4b6d-9c29-ae82cff2925f}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f6b6e965-e9b2-444b-9286-10c9152edbc5}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f6b6e965-e9b2-444b-9286-10c9152edbc5}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f82df8f7-8b9f-442e-a48c-818ea735ff9b}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f82df8f7-8b9f-442e-a48c-818ea735ff9b}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F96E2F30-2018-4F0E-BBEE-7CCBEE8CE714}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f96e2f30-2018-4f0e-bbee-7ccbee8ce714}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FADA4BFB-4853-4547-B70F-1B565E7D907B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{fada4bfb-4853-4547-b70f-1b565e7d907b}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FD4FB8FA-F752-4E78-933B-8969E18BC9B5}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{fd4fb8fa-f752-4e78-933b-8969e18bc9b5}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FE777427-D33C-485B-A414-3BD5A2943162}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{fe777427-d33c-485b-a414-3bd5a2943162}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FEBB9292-6110-4B9E-8565-91C4076E0A43}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{febb9292-6110-4b9e-8565-91c4076e0a43}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FEFF8F5D-EB40-485d-AC2A-EB7942DDF624}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{feff8f5d-eb40-485d-ac2a-eb7942ddf624}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FFA33B6C-DC4D-438C-893F-EBF44A09BFC0}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ffa33b6c-dc4d-438c-893f-ebf44a09bfc0}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\ControlPanel.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\controlpanel.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\CortanaSettings.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\cortanasettings.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_0_FlashPlayerCPLApp.cpl.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_0_flashplayercplapp.cpl.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{025A5937-A6BE-4686-A844-36FE4BEC8B6D}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{025a5937-a6be-4686-a844-36fe4bec8b6d}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{60632754-c523-4b62-b45c-4172da012619}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{60632754-c523-4b62-b45c-4172da012619}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{6C8EEC18-8D75-41B2-A177-8831D59D2D50}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{6c8eec18-8d75-41b2-a177-8831d59d2d50}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{7b81be6a-ce2b-4676-a29e-eb907a5126c5}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{7b81be6a-ce2b-4676-a29e-eb907a5126c5}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{96AE8D84-A250-4520-95A5-A47A7E3C548B}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{96ae8d84-a250-4520-95a5-a47a7e3c548b}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{b98a2bea-7d42-4558-8bd1-832f41bac6fd}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{d8559eb9-20c0-410e-beda-7ed416aecc2a}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{F942C606-0914-47AB-BE56-1321B8035096}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{f942c606-0914-47ab-be56-1321b8035096}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\SettingsPane_{4B719A8A-CE18-4033-BE59-1083B40F25B7}.settingcontent-ms", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\settingspane_{4b719a8a-ce18-4033-be59-1083b40f25b7}.settingcontent-ms", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\LocalState\\_sessionState.xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\localstate\\_sessionstate.xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-wal", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-wal", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppTracing_BGTask.etl", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\photosapptracing_bgtask.etl", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppTracing_BGTask.last.etl", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\photosapptracing_bgtask.last.etl", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.chk", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00037.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00037.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00038.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00038.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00039.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00039.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003A.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003a.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003B.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003b.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003C.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003c.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00001.jrs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbres00001.jrs", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00002.jrs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbres00002.jrs", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\EJEHAMU5.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\ejehamu5.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\LVKKMMVN.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\lvkkmmvn.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\MSIMGSIZ.DAT", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\msimgsiz.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\apps.18396.9007199266244209.fa7ca9c1-d3a4-4eac-8c88-d73453e5d352[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\apps.18396.9007199266244209.fa7ca9c1-d3a4-4eac-8c88-d73453e5d352[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\apps.28613.9007199266247640.e66db940-c7c0-4b3c-8b72-fc5046092266[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\apps.28613.9007199266247640.e66db940-c7c0-4b3c-8b72-fc5046092266[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\apps.40721.13510798885083716.d6e04241-8ff4-41b0-a3a3-43b1ced6a08f[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\apps.40721.13510798885083716.d6e04241-8ff4-41b0-a3a3-43b1ced6a08f[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\apps.48711.9007199266245096.7eed2a71-671f-4c26-9d68-6141c842f285[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\apps.48711.9007199266245096.7eed2a71-671f-4c26-9d68-6141c842f285[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\apps.55454.9007199266251611.8dc5de70-2b9f-4603-9d21-3f915579a269[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\apps.55454.9007199266251611.8dc5de70-2b9f-4603-9d21-3f915579a269[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\zinc[1].htm", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\zinc[1].htm", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\zinc[2].htm", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\zinc[2].htm", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\0a5c1b58[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\0a5c1b58[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\2dd47e28[2].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\2dd47e28[2].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\apps.18578.9007199266246289.6f80413a-747a-465c-b810-b44f77d3084f[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\apps.18578.9007199266246289.6f80413a-747a-465c-b810-b44f77d3084f[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\apps.4100.9007199266251606.ae3c4a65-bf6f-4459-94e4-f5be923c9a5f[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\apps.4100.9007199266251606.ae3c4a65-bf6f-4459-94e4-f5be923c9a5f[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\apps.46520.13510798887155710.5365405a-2cb4-48a2-a90e-8ae898fcabf1[1].jpg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\apps.46520.13510798887155710.5365405a-2cb4-48a2-a90e-8ae898fcabf1[1].jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\apps.58775.9007199266677760.2c69fa74-238e-4e64-af60-87ffbeed7326[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\apps.58775.9007199266677760.2c69fa74-238e-4e64-af60-87ffbeed7326[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\f18fc33f[1].css", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\f18fc33f[1].css", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\3Y24VK53\\apps.40361.9007199266251851.16146db2-5f86-4fcc-852d-95bf0325db35[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\3y24vk53\\apps.40361.9007199266251851.16146db2-5f86-4fcc-852d-95bf0325db35[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\3Y24VK53\\e6e099c1[1].css", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\3y24vk53\\e6e099c1[1].css", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\3Y24VK53\\th[1].jpg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\3y24vk53\\th[1].jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\3Y24VK53\\th[2].jpg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\3y24vk53\\th[2].jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\apps.15191.9007199266251530.cc19d652-3ab6-4535-a2c7-c576698c252d[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\apps.15191.9007199266251530.cc19d652-3ab6-4535-a2c7-c576698c252d[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\apps.24307.9007199266288952.82b35dd7-0a28-4339-a027-0c1d7303f65b[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\apps.24307.9007199266288952.82b35dd7-0a28-4339-a027-0c1d7303f65b[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\apps.4415.9007199266394310.e7a8b9d9-3bd7-4aed-98a9-eb467c12dfda[1].png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\apps.4415.9007199266394310.e7a8b9d9-3bd7-4aed-98a9-eb467c12dfda[1].png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\e8bd5198[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\e8bd5198[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\th[1].jpg", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\th[1].jpg", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\zinc[1].htm", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\zinc[1].htm", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\appcache[1].man", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\appcache[1].man", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\appcache[1].man", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\appcache[1].man", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\17bd1fca[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\17bd1fca[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\1acd62c3[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\1acd62c3[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\284df389[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\284df389[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3775eb01[1].css", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3775eb01[1].css", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3e533cad[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3e533cad[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\4c68d3b2[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\4c68d3b2[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\74843a82[1].css", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\74843a82[1].css", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\85441a2e[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\85441a2e[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\916eb510[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\916eb510[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\932ee198[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\932ee198[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\a137b088[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\a137b088[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\appcache[1].man", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\appcache[1].man", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\b99bbd2f[1].css", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\b99bbd2f[1].css", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\c71b7416[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\c71b7416[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\ca2ffdc0[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\ca2ffdc0[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\ce6a624f[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\ce6a624f[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e4709542[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e4709542[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e48237f6[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e48237f6[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e994e448[1].css", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e994e448[1].css", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\f544a93b[1].css", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\f544a93b[1].css", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\appcache[1].man", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\appcache[1].man", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\1500601998", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\1500601998", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\001107b94f5293b397165f26d15a256e62b7d4a8a9228f3093ac37da2be5b24f", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\001107b94f5293b397165f26d15a256e62b7d4a8a9228f3093ac37da2be5b24f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2bed4133f7a5cd078ac3c621dfa8e6362121ce0928c026612a1f1ddf4f99a370", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2bed4133f7a5cd078ac3c621dfa8e6362121ce0928c026612a1f1ddf4f99a370", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2d8669052d2b7df8dd4b9607f2379c68aea752aafe0def6d5ce226264835a7ca", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2d8669052d2b7df8dd4b9607f2379c68aea752aafe0def6d5ce226264835a7ca", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3a53c604f9aa7fa34010083e9e398486423e851c704b4d50043aaf2a8574d9b2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3a53c604f9aa7fa34010083e9e398486423e851c704b4d50043aaf2a8574d9b2", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3a65241e49133a96904d70724844acb053dc753d3ab27f93e89f8059cbccdb92", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3a65241e49133a96904d70724844acb053dc753d3ab27f93e89f8059cbccdb92", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\440989d816ce3a311a914b13a22ba992f95690849d761ffa5caab5959db0c921", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\440989d816ce3a311a914b13a22ba992f95690849d761ffa5caab5959db0c921", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\7053f8c6068c46e40f1016f56c5a556103340ef5fe7752801b7744069ae0f861", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\7053f8c6068c46e40f1016f56c5a556103340ef5fe7752801b7744069ae0f861", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8567d7efc6dd43319b076ebebb98cc2abd2520838a9ebd41597e4052b4bd2a22", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8567d7efc6dd43319b076ebebb98cc2abd2520838a9ebd41597e4052b4bd2a22", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\86f03f60d39829e5fba5aa195da9eedb1ad88e99410bf7fa169d1558aaf35bdd", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\86f03f60d39829e5fba5aa195da9eedb1ad88e99410bf7fa169d1558aaf35bdd", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\91dd86d2e068177d1504451bc4f923d177183c305ba3a521ebe87a3ca889ed90", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\91dd86d2e068177d1504451bc4f923d177183c305ba3a521ebe87a3ca889ed90", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\d6f3a2f0c0f5d4ad6cab70713323cac7710e91ff13667b2200b6b800881ac10f", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\d6f3a2f0c0f5d4ad6cab70713323cac7710e91ff13667b2200b6b800881ac10f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\f7df316937e894c20be9f8a6fc118847e60ea2dfe33cc1924f24346307e2b268", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\f7df316937e894c20be9f8a6fc118847e60ea2dfe33cc1924f24346307e2b268", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.chk", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.chk", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbres00001.jrs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbres00001.jrs", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbres00002.jrs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbres00002.jrs", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbtmp.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DomainSuggestions\\en-US.1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\domainsuggestions\\en-us.1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\edb.chk", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\edb.chk", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbres00001.jrs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbres00001.jrs", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbres00002.jrs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbres00002.jrs", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbtmp.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\P1T4DCFU\\www.msn[1].xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\p1t4dcfu\\www.msn[1].xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\ETFMMWBM\\www.bing[1].xml", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\etfmmwbm\\www.bing[1].xml", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\appcache[1].man", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\appcache[1].man", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Init[1].htm", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\init[1].htm", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51TU1403.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51tu1403.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5GJKP08H.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5gjkp08h.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\6NQ9V8CD.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\6nq9v8cd.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\JZ1UUUP9.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\jz1uuup9.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\KW0ULAFV.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\kw0ulafv.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\SW6Z4AI1.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\sw6z4ai1.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\TU6XBKFE.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\tu6xbkfe.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\U9PT9V3Q.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\u9pt9v3q.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\msimgsiz.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1zja02jo.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\268tpjia.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\6kwa3r8c.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\85dgk2j5.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fpndv7t3.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\j9kflzdx.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jn00akv9.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\or8k8vrm.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\tk0lxhbl.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vc62gjsf.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vsmdvd55.txt", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\settings.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\postSigningData", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\postsigningdata", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\directoryLinks.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\directorylinks.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\frequencyCap.json", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\frequencycap.json", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\_CACHE_CLEAN_", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\_cache_clean_", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\startupCache\\startupCache.4.little", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\startupcache\\startupcache.4.little", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\base-track-digest256.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\base-track-digest256.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\base-track-digest256.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\base-track-digest256.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-badbinurl-shavar.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-badbinurl-shavar.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-badbinurl-shavar.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-badbinurl-shavar.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-downloadwhite-digest256.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-downloadwhite-digest256.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-malware-shavar.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-malware-shavar.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-malware-shavar.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-malware-shavar.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-phish-shavar.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-phish-shavar.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-phish-shavar.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-phish-shavar.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-unwanted-shavar.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-unwanted-shavar.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-unwanted-shavar.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-unwanted-shavar.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\mozplugin-block-digest256.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\mozplugin-block-digest256.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\mozplugin-block-digest256.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\mozplugin-block-digest256.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\mozstd-trackwhite-digest256.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\mozstd-trackwhite-digest256.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-block-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-block-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-block-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-block-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flash-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flash-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flash-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flash-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flashallow-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flashallow-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flashallow-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flashallow-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flashsubdoc-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flashsubdoc-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flashsubdoc-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flashsubdoc-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-malware-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-malware-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-malware-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-malware-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-phish-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-phish-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-phish-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-phish-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-track-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-track-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-track-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-track-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-trackwhite-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-trackwhite-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-trackwhite-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-trackwhite-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-unwanted-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-unwanted-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-unwanted-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-unwanted-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flash-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flash-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flash-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flash-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashallow-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashallow-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashallow-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashallow-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\OfflineCache\\index.sqlite", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\offlinecache\\index.sqlite", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\4mkHR_p+Wn_2AEZoGYTTQQ==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\4mkhr_p+wn_2aezogyttqq==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\asRZLAIfRhwB7KZygffeFA==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\asrzlaifrhwb7kzygffefa==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\d+wy3cvuncc3wva6du1bzg==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\DiktK+QHhLcJqWKZ9_VsTA==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\diktk+qhhlcjqwkz9_vsta==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\dLcXOMhmEiiUNPBG1nL8Ew==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\dlcxomhmeiiunpbg1nl8ew==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\GNtk5OH7OPlVUCH7Ue1nuw==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\gntk5oh7oplvuch7ue1nuw==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\iNtr8V5+A8pq96nV92I9rg==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\intr8v5+a8pq96nv92i9rg==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KMkld2mykTtwKDykdZ4gNA==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kmkld2mykttwkdykdz4gna==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KykeNQT8cz0GP+hqz5mIpw==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kykenqt8cz0gp+hqz5mipw==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\kZbAJfgDibZzMvDTka320Q==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kzbajfgdibzzmvdtka320q==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\K_jbA2CUeAAOJVMrlKk+gQ==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\k_jba2cueaaojvmrlkk+gq==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\mgDer72BXyCa3ilaVifttQ==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\mgder72bxyca3ilavifttq==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\obXqSkYxtPxKEzhnvwJwjg==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\obxqskyxtpxkezhnvwjwjg==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\ttwZSCROfkViyTVqAFLXrw==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\ttwzscrofkviytvqaflxrw==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\XUMtyI1WhW2H+uz6m0iFOw==.ico", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\xumtyi1whw2h+uz6m0ifow==.ico", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index.log", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index.log", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\00230E843D3A08B230E933E226DB601D643BC852", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\00230e843d3a08b230e933e226db601d643bc852", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\00396519A728CAF55BA5985F2822E3CD29D0B17E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\00396519a728caf55ba5985f2822e3cd29d0b17e", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0070686314FCF810B3CEE062939E2805C4894837", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0070686314fcf810b3cee062939e2805c4894837", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\01936D44B3D7F728EFEB4C28574EF44AB7260A17", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\01936d44b3d7f728efeb4c28574ef44ab7260a17", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\01CC9F4D43A947CA6202BA62A7FFF28C6881C1BF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\01cc9f4d43a947ca6202ba62a7fff28c6881c1bf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\01D69525274B61DE5FF860EF9BDF5BEDBB7E52C6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\01d69525274b61de5ff860ef9bdf5bedbb7e52c6", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\023DB71E21A04D5A6CE60A1EC2C15A40BE00DD08", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\023db71e21a04d5a6ce60a1ec2c15a40be00dd08", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\02556929CF2E7913AF6E896368676F9BEC324DF4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\02556929cf2e7913af6e896368676f9bec324df4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\025E6C3190211A09D15D92E5656FB71220B7737E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\025e6c3190211a09d15d92e5656fb71220b7737e", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0396D4FE028249B03B952ECAC5BDC2698D7AC41D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0396d4fe028249b03b952ecac5bdc2698d7ac41d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\04407A80544B9CDDB0BF74A9C5090D338DED55E6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\04407a80544b9cddb0bf74a9c5090d338ded55e6", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\04825B72BD3FF3B25000EE8B3660F3E1748CF56D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\04825b72bd3ff3b25000ee8b3660f3e1748cf56d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\04DDA15772BB1EBE40F174D3D0AD961AB0D85881", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\04dda15772bb1ebe40f174d3d0ad961ab0d85881", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\04E42D40E9FF818034B152EBBD5D2648E474B06E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\04e42d40e9ff818034b152ebbd5d2648e474b06e", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\053023C6ABE9799C7CBA3D16BB67C1B7F7B0D8A0", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\053023c6abe9799c7cba3d16bb67c1b7f7b0d8a0", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\062AD3657B516BAF21B6D366104D405078541BA6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\062ad3657b516baf21b6d366104d405078541ba6", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\073B56D883E94B03370493A96DF99C2B51FB3E9D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\073b56d883e94b03370493a96df99c2b51fb3e9d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0782E7F698BE212FDCB80D8DE2C97C611AE50DFF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0782e7f698be212fdcb80d8de2c97c611ae50dff", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\085CFB45496B3087ABCB8ABD8529B3EB41D17C27", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\085cfb45496b3087abcb8abd8529b3eb41d17c27", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0A1144B8734850F5325AA6C259041EA8A201062C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0a1144b8734850f5325aa6c259041ea8a201062c", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0A774848D5BE9E32A6789642784FD4DAFCD580F5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0a774848d5be9e32a6789642784fd4dafcd580f5", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0A9B36C9F5BCA2621C56BD4B714A9141238CF27D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0a9b36c9f5bca2621c56bd4b714a9141238cf27d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0ADCF0E2A022CEDF8D199ED2889DB295128C4E25", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0adcf0e2a022cedf8d199ed2889db295128c4e25", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0B55D23F82EE119DC0472267436CD5F2868E3B14", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0b55d23f82ee119dc0472267436cd5f2868e3b14", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0BCD5C644E4A81783F24DB39416D1CE0CA0C3015", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0bcd5c644e4a81783f24db39416d1ce0ca0c3015", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0CFEB549E537F8B2151A62BA069AE7A6D363BB90", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0cfeb549e537f8b2151a62ba069ae7a6d363bb90", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0D1B36E62742C7776D68B1240296D02DFD6478FF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0d1b36e62742c7776d68b1240296d02dfd6478ff", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0D83D658A0C069047F6B9FD30BFDEDD80863B5F0", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0d83d658a0c069047f6b9fd30bfdedd80863b5f0", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0E030AE41B2AB97664B455929A8A0721BA5D1F69", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0e030ae41b2ab97664b455929a8a0721ba5d1f69", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0E331C2EF53B5C952B79B038C00588087D45A128", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0e331c2ef53b5c952b79b038c00588087d45a128", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0EC55DA246CC743C7EEA604EB85A206384B78D8F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0ec55da246cc743c7eea604eb85a206384b78d8f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0EFA10E4516ACC80858411CA65A3CFF2B1AB347D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0efa10e4516acc80858411ca65a3cff2b1ab347d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0FCD257674B1DEC53E0617114C11061F0395BE84", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0fcd257674b1dec53e0617114c11061f0395be84", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0FEE7E531224DDC68090378EA0DD267E4A43A052", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0fee7e531224ddc68090378ea0dd267e4a43a052", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\10242BACB3A923DC9924A5B41FC879A31AF03963", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\10242bacb3a923dc9924a5b41fc879a31af03963", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\102DC0B203B92AE5ADA25E34CEB5788226CA2769", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\102dc0b203b92ae5ada25e34ceb5788226ca2769", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\102E001FB34D784FBF727701C7932E3FC58AF45D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\102e001fb34d784fbf727701c7932e3fc58af45d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\108573E2B07FF25FFCAFE37F58D375561A47424D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\108573e2b07ff25ffcafe37f58d375561a47424d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\116D5E76041E1DFC3004D30FEEB76351BB9D361F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\116d5e76041e1dfc3004d30feeb76351bb9d361f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1355867C7C8ACB52152CDC249B64D742CC40340D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1355867c7c8acb52152cdc249b64d742cc40340d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1367E452AEFAA74CB544B69373FCCBB6C0E95AEB", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1367e452aefaa74cb544b69373fccbb6c0e95aeb", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1380A3F977C9CB8D60BD5A90243F6A04E42FAD04", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1380a3f977c9cb8d60bd5a90243f6a04e42fad04", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\13871F2088220BCD932D60C30C272709DEAABB04", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\13871f2088220bcd932d60c30c272709deaabb04", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1456D316BEE665C776E86DC63D0F546BA069BFBE", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1456d316bee665c776e86dc63d0f546ba069bfbe", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\14786BE4B1040FAE49EABD0E2222B7EDCC6DF321", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\14786be4b1040fae49eabd0e2222b7edcc6df321", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\14926D90946B0F4BA2FCA38D75A5FBA83EF29AD0", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\14926d90946b0f4ba2fca38d75a5fba83ef29ad0", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\14bf1b21a28d68d02d3cf7a0ca4d66159596ecd1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1531FBE50CE357526C558EE71AA60FC4D2E29E0C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1531fbe50ce357526c558ee71aa60fc4d2e29e0c", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\15704E847DCFEC6E9A511A8897461209C820C052", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\15704e847dcfec6e9a511a8897461209c820c052", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\15E4224DA48B83948028AEBE08751418DBDE4688", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\15e4224da48b83948028aebe08751418dbde4688", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\16103553C2544720A8768AAA60212BE5916A4CE9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\16103553c2544720a8768aaa60212be5916a4ce9", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\16114BA75206B6FA4C51ADC8A73DB4C6635F6AF9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\16114ba75206b6fa4c51adc8a73db4c6635f6af9", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\165A82B735DDDE6F05E29A770A52297EAE982902", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\165a82b735ddde6f05e29a770a52297eae982902", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\16656B13E13FB159C452E606297943961E41BD83", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\16656b13e13fb159c452e606297943961e41bd83", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\167109A0C523F60F2197836B0BCDA9B52A4D16AE", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\167109a0c523f60f2197836b0bcda9b52a4d16ae", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\170F54EDBE19BE8676CC69B53BAC08C8932D118A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\170f54edbe19be8676cc69b53bac08c8932d118a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1722A63DF48E38B5DC308AE741FBFA24F762D8AC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1722a63df48e38b5dc308ae741fbfa24f762d8ac", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\17FDE78A9ACA4445D5D13C94208BC4B0E4BA046A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\17fde78a9aca4445d5d13c94208bc4b0e4ba046a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1801CFE5BC39C5B24721E8CB2F32854EF5C5F96A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1801cfe5bc39c5b24721e8cb2f32854ef5c5f96a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1833D74FE9FD5E002D12AD1D5CE9845C539E6D49", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1833d74fe9fd5e002d12ad1d5ce9845c539e6d49", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\19B6A58F54F979D1CF008970B9B0D36B11B7944D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\19b6a58f54f979d1cf008970b9b0d36b11b7944d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1A7C641FFE043BB811768257AF97546A0C7F3B55", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1a7c641ffe043bb811768257af97546a0c7f3b55", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1AA5AFB1639FED28192BC2781A550C89494CDF9A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1aa5afb1639fed28192bc2781a550c89494cdf9a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1ADEB94741EA84BB04219DA402BBC420B5512A2A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1adeb94741ea84bb04219da402bbc420b5512a2a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1C7A6CE17940A6C75210FA60C52339417DEDEEFA", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1c7a6ce17940a6c75210fa60c52339417dedeefa", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1C849477DE15B1F8F2245945F3F44468F58146DF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1c849477de15b1f8f2245945f3f44468f58146df", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1D719B3EE2A34A4E2DC9D0A4EAE1DF7948EA5A46", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1d719b3ee2a34a4e2dc9d0a4eae1df7948ea5a46", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1D8C7F5B73A4CD02E54F20A75B1FC29BE8E2EE8B", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1d8c7f5b73a4cd02e54f20a75b1fc29be8e2ee8b", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1D94118C6FBA173AC2CE7C335C3CB9B7365F1E90", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1d94118c6fba173ac2ce7c335c3cb9b7365f1e90", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1DBC56BBF48819D9CC9E96F72309A2D366DD1B72", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1dbc56bbf48819d9cc9e96f72309a2d366dd1b72", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1DCB6E830B5F6182674047BC07BE94E869A82DC1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1dcb6e830b5f6182674047bc07be94e869a82dc1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1e4c1de6d9bc3c738cb37d3d4e0cccdbdd4ec3e7", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1E654765DD4C0B7A97A94BA7430FF4F02539B4D4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1e654765dd4c0b7a97a94ba7430ff4f02539b4d4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1eb2e405e2b5aff18dbd87bbfb385eed242a1ab5", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1F03C5BEB6690C5E65013ADC12747A8FB0266E74", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1f03c5beb6690c5e65013adc12747a8fb0266e74", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1F101A980B722E67F1FB3F0366EA9E520FB47D1B", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1f101a980b722e67f1fb3f0366ea9e520fb47d1b", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1f58b2f46f6c2de8ff822405ac18a18128d0bbbc", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\20343A86FB834223CC13D33560122837208F7563", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\20343a86fb834223cc13d33560122837208f7563", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\209D12DF1554481FBDC90931601991A892F798E7", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\209d12df1554481fbdc90931601991a892f798e7", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2118755562A693569EE2423CB1A2136CB8F1D9CC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2118755562a693569ee2423cb1a2136cb8f1d9cc", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\212CB67D7B36A171AAF7F0B1E24E5ADC687ACDCF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\212cb67d7b36a171aaf7f0b1e24e5adc687acdcf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2144C082C2AC8FA4FB4863D9D3BE7E335DD2C91D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2144c082c2ac8fa4fb4863d9d3be7e335dd2c91d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\21870284BD46D6F21E756FF12837E26AC55D301D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\21870284bd46d6f21e756ff12837e26ac55d301d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\21B0E0F8C11507CB07A1BB82407F5AD646D80836", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\21b0e0f8c11507cb07a1bb82407f5ad646d80836", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\224A275AD09BE370F96D409F6AFE2904589080EC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\224a275ad09be370f96d409f6afe2904589080ec", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\225640F98EF31B52AB76CF756A5C3512E0BDE89B", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\225640f98ef31b52ab76cf756a5c3512e0bde89b", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\22777C6913A6B4768EE40D5F0103A93D8B477C3C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\22777c6913a6b4768ee40d5f0103a93d8b477c3c", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\22B072DE2E829A9BBDD29C6C1005CBE946651C89", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\22b072de2e829a9bbdd29c6c1005cbe946651c89", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\22CA1C7BCD8AA6B0D991889ABE75C06CA1EBACD1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\22ca1c7bcd8aa6b0d991889abe75c06ca1ebacd1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\24073350A672357B47B2D1A937642146E80AA938", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\24073350a672357b47b2d1a937642146e80aa938", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2445FA966A09E6B22679F2707AA980BBEBBC3BA8", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2445fa966a09e6b22679f2707aa980bbebbc3ba8", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\245CEDA973B44C04325E8F3063F7596F9C88F120", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\245ceda973b44c04325e8f3063f7596f9c88f120", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2465113476A71563C2561E1A45DF343E04BFF787", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2465113476a71563c2561e1a45df343e04bff787", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\24be475a5c9ce3da33684dfdee6ac47bc9ba6de6", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\24C5A11C7C55D609ED86B6E31E2C94301D075CB3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\24c5a11c7c55d609ed86b6e31e2c94301d075cb3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\24F9514653FD834D9D33E21B4C0AECB308550A9A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\24f9514653fd834d9d33e21b4c0aecb308550a9a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2530EF3224B6681D2B34ED5DB0B170C716EB1E39", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2530ef3224b6681d2b34ed5db0b170c716eb1e39", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2587F851FECE6E69F3B26E54EDE4E02BD3C1D496", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2587f851fece6e69f3b26e54ede4e02bd3c1d496", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2598a1cbb2ea6db15dff6382e5b17f41b01b4f0e", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\25AFA0D28E7333EEE9F600A4A4F5B1C37A33789F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\25afa0d28e7333eee9f600a4a4f5b1c37a33789f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\26686166E96A3EBDAC2ED90D8F9B4ECD22BBB577", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\26686166e96a3ebdac2ed90d8f9b4ecd22bbb577", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\26926D1CDB0298F2781D6FAD532518F7C8B787DA", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\26926d1cdb0298f2781d6fad532518f7c8b787da", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\26C8D0872DE7292BC9C7F54426A5E887557300EA", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\26c8d0872de7292bc9c7f54426a5e887557300ea", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\26D5902E65F2EC88B7E5ED33E815A3FDBE18E10F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\26d5902e65f2ec88b7e5ed33e815a3fdbe18e10f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\270900E85767111BD4C54667E304A0B6656EA0A0", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\270900e85767111bd4c54667e304a0b6656ea0a0", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\273736E26CFF7795BE550BE3B37B1D4598946999", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\273736e26cff7795be550be3b37b1d4598946999", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\28380882022BE365EDE32586CD158C635B9BE8D1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\28380882022be365ede32586cd158c635b9be8d1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\28D18C8667B2E4C79E3CE2766CF075BBFA55C129", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\28d18c8667b2e4c79e3ce2766cf075bbfa55c129", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\28DAEEA417486B2D8FF609CC22C0244D45F802F7", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\28daeea417486b2d8ff609cc22c0244d45f802f7", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\291F29EF92755427DA03AB115BD92B68F34AB659", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\291f29ef92755427da03ab115bd92b68f34ab659", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\297135C089B3661F5AABB8E90985C6930164B685", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\297135c089b3661f5aabb8e90985c6930164b685", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2a650cb5032027b0ef79f4b9916c5d43eefedb3a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2A705BA174D08F119A903AD6AE391B16AE92D9FC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2a705ba174d08f119a903ad6ae391b16ae92d9fc", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2aeea30e1abf20ce6edcd6534789a8a96595e87a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2B662789DFDD9C1308FF8ECD48E05F393053163C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2b662789dfdd9c1308ff8ecd48e05f393053163c", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2C18FE48FBDBA136A5EC51C8B9D4382D2452C359", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2c18fe48fbdba136a5ec51c8b9d4382d2452c359", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2C40C733B84018F500F4F551FC53305A5971F05F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2c40c733b84018f500f4f551fc53305a5971f05f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2C5330B3725C70F20F4BC8A5385F696CC68B83C6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2c5330b3725c70f20f4bc8a5385f696cc68b83c6", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2C706476EF0944CD159653F65034A1071345205C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2c706476ef0944cd159653f65034a1071345205c", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2CCFCBE257B8F5BE4FEAF68C08171DAF22AEED89", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2ccfcbe257b8f5be4feaf68c08171daf22aeed89", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2D062CF6D6777E6BD7D9D53DBAB84CA6329C9727", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2d062cf6d6777e6bd7d9d53dbab84ca6329c9727", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2D693D07DD992FA2955C9EDE27FDA78487556E32", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2d693d07dd992fa2955c9ede27fda78487556e32", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2d7db1f2a5bbde7db3035cea82134d2cf20d58ae", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2E08CDAEE955A40889AC5877BE194C7EF12394A5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2e08cdaee955a40889ac5877be194c7ef12394a5", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2E2D3BD78AAC7DD8EC8B5CA26C36A64A912EA68B", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2e2d3bd78aac7dd8ec8b5ca26c36a64a912ea68b", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2E78209F2BD7068695BB80AAE0D3E5F19A372BCA", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2e78209f2bd7068695bb80aae0d3e5f19a372bca", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2eaff2699fcee0edfef4ff824c07727f657b0d45", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2F0A7F5A4CF50FBAA8EC8FB9F3EBEF7461E5FA83", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2f0a7f5a4cf50fbaa8ec8fb9f3ebef7461e5fa83", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2FD2E2A71F89E3A92F68CB796207228217259289", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2fd2e2a71f89e3a92f68cb796207228217259289", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2FEB6245AA212EA51F79468084964097925BD6D6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2feb6245aa212ea51f79468084964097925bd6d6", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\311C19847187CC20C5A8A21FA39C6639F5BBCF67", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\311c19847187cc20c5a8a21fa39c6639f5bbcf67", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\31220725946AC054F523C4029C40CA22A7A42621", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\31220725946ac054f523c4029c40ca22a7a42621", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\31592C8B017CA0508B5F0339E7E1EA46376F2D31", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\31592c8b017ca0508b5f0339e7e1ea46376f2d31", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\317E80FB14217F5F6E8EAB3C4982A166EBEDBC9C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\317e80fb14217f5f6e8eab3c4982a166ebedbc9c", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3194BBD824DE5F4E0F44B99C71BB6C700199B487", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3194bbd824de5f4e0f44b99c71bb6c700199b487", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\31F8F1DF56894B1D3F2180DB7128624160D6FD5E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\31f8f1df56894b1d3f2180db7128624160d6fd5e", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3221C03D33E21E6F8B41DB86EB7B6527177AD6F9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3221c03d33e21e6f8b41db86eb7b6527177ad6f9", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\32AFE38EED991EA004851E7C968397C7D9EA501C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\32afe38eed991ea004851e7c968397c7d9ea501c", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\32B6927A1EB46E83B230070265358A1C5B788D11", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\32b6927a1eb46e83b230070265358a1c5b788d11", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3313B622F3B9896C056CB0A1A534E4C91732E665", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3313b622f3b9896c056cb0a1a534e4c91732e665", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\338233A5FF4B5082E562A4B5BFBCDB2581DE81E6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\338233a5ff4b5082e562a4b5bfbcdb2581de81e6", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\339A4E96E26DFFA4704F0AF081D2B85B12D03939", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\339a4e96e26dffa4704f0af081d2b85b12d03939", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\33A34037B96BD19CC90C0A382CEDF384EE052FCC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\33a34037b96bd19cc90c0a382cedf384ee052fcc", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\33B10E2C53E1205B7527185F086F1BD9A39B07CD", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\33b10e2c53e1205b7527185f086f1bd9a39b07cd", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\33E49DB212B852799023F439D16990005F93C4F7", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\33e49db212b852799023f439d16990005f93c4f7", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\33E659B30B4E594B210633855AC841A47BB4BBB9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\33e659b30b4e594b210633855ac841a47bb4bbb9", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\346330431993BC995E9F9C114FE39FD5B54EB7DF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\346330431993bc995e9f9c114fe39fd5b54eb7df", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\34CEF73D25CB0DE8A1CD86FB09EF24D17790BCA7", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\34cef73d25cb0de8a1cd86fb09ef24d17790bca7", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3502F57243FBD8F9D25E093A72D603074783A304", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3502f57243fbd8f9d25e093a72d603074783a304", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\356FCE9F932692DC643481DBA1ABEA937B629F58", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\356fce9f932692dc643481dba1abea937b629f58", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\35933C361338037A97583E92DA61C299851A9B4E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\35933c361338037a97583e92da61c299851a9b4e", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\36A422C04312727A6116F45E357EDA80B3B4A6FD", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\36a422c04312727a6116f45e357eda80b3b4a6fd", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\36C5C19636CA8995D6ADCD176668444451854326", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\36c5c19636ca8995d6adcd176668444451854326", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\36DBE72541419953BE4A8BD61964782F4DBEDECF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\36dbe72541419953be4a8bd61964782f4dbedecf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\376ED25A1DE94F0D96E985E5D5CACFCFE3812131", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\376ed25a1de94f0d96e985e5d5cacfcfe3812131", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\37B0298825F693E093744779A7278E41F1419493", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\37b0298825f693e093744779a7278e41f1419493", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\37B4BC98C8FDD6283BE80C5CC385582FEF5D6747", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\37b4bc98c8fdd6283be80c5cc385582fef5d6747", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\37BC32B4B7033C1AB388018EC734B639086C814E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\37bc32b4b7033c1ab388018ec734b639086c814e", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\383704E4BB07D527519A7352BA38B681C661FD8F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\383704e4bb07d527519a7352ba38b681c661fd8f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\38819CF0EDDF28F6C7AE4A62EA2DC0E07EA71115", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\38819cf0eddf28f6c7ae4a62ea2dc0e07ea71115", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\39CC8AA9054EC6244CA281EEA4BD937517E2861D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\39cc8aa9054ec6244ca281eea4bd937517e2861d", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\39D606C35C00ADA6E9320E1F6431E5A33EB42182", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\39d606c35c00ada6e9320e1f6431e5a33eb42182", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3A554E4EFCC1FAD19E963D27B9A2BF73C9664268", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3a554e4efcc1fad19e963d27b9a2bf73c9664268", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3A6C331288F156E9A07E3EA398F3A8FAF0530D8F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3a6c331288f156e9a07e3ea398f3a8faf0530d8f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3B3EDC129FE6ED020C044AC637791DEC8B6B7603", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3b3edc129fe6ed020c044ac637791dec8b6b7603", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3D896079491CA68DD9BB6DB7E612C8DC74463279", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3d896079491ca68dd9bb6db7e612c8dc74463279", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3DE1033D1165F9D849E6DFD8566ABB9179DB1D0F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3de1033d1165f9d849e6dfd8566abb9179db1d0f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3E42820479FADF666581B0704FA4AF901AE0E045", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3e42820479fadf666581b0704fa4af901ae0e045", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3EA580E2FD537915B7084615630F0189274B1F60", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3ea580e2fd537915b7084615630f0189274b1f60", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3FAECD8F44CECB41F5586C0DC333275FC173593A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3faecd8f44cecb41f5586c0dc333275fc173593a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3FB6DE7747DC1B658385638D277CF2D620D232E4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3fb6de7747dc1b658385638d277cf2d620d232e4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\400E86363026A9AC2DCD2221C145C6370E3E8EDA", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\400e86363026a9ac2dcd2221c145c6370e3e8eda", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4030DFFE47D5B75257AA7A8C0A26B737E2F00FF3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4030dffe47d5b75257aa7a8c0a26b737e2f00ff3", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\40645D76E586E360D63982B2D4525920F0CF3060", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\40645d76e586e360d63982b2d4525920f0cf3060", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\406839CA18775158E58D75B2837624917D7E685C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\406839ca18775158e58d75b2837624917d7e685c", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\407eb4de353de3ad4e1a29f0e0e84f65c2ce6e3a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\41367369B0154D1D2566CC216318C71115E089A2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\41367369b0154d1d2566cc216318c71115e089a2", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4238786CB87B503754EE13346F30AE3FCE28174F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4238786cb87b503754ee13346f30ae3fce28174f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\425AB3A135AC92C5F7A29092F686A777B30A8C0A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\425ab3a135ac92c5f7a29092f686a777b30a8c0a", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\42C23BB7242DFE074931A302B5BEB9B1D73B0BA5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\42c23bb7242dfe074931a302b5beb9b1d73b0ba5", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\431BDCA04B51BE586DFCF48431166463879B3DBF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\431bdca04b51be586dfcf48431166463879b3dbf", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\434A5C8B5D0BEF67CEEB6076803A286CAE99C8C9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\434a5c8b5d0bef67ceeb6076803a286cae99c8c9", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\43686105AC844B29A19E4AD788A5ABBD2714FC75", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\43686105ac844b29a19e4ad788a5abbd2714fc75", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\438AB448ED7FB7D99CB7CFAB433F9E19A475D0EF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\438ab448ed7fb7d99cb7cfab433f9e19a475d0ef", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\43A641B524487AFDAC7A8AF548EE196228BF6EAE", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\43a641b524487afdac7a8af548ee196228bf6eae", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\44437BAE601C72F5ED96953EAE92C527D4C2D46F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\44437bae601c72f5ed96953eae92c527d4c2d46f", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4453CB40F54977CDF96034A3A658080FDA7E43FA", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4453cb40f54977cdf96034a3a658080fda7e43fa", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\445E695F447CA967C4DAE00C80034130290F80EA", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\445e695f447ca967c4dae00c80034130290f80ea", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\45A759AC8024EF1FCC5ECA005CEB9C4A4F78984E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\45a759ac8024ef1fcc5eca005ceb9c4a4f78984e", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\45C64E5C2E9809667C5FC9F06FC42641326DF768", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\45c64e5c2e9809667c5fc9f06fc42641326df768", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4613B437E86D18E98F830433A5E6F7F9ABAF3693", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4613b437e86d18e98f830433a5e6f7f9abaf3693", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\467A961D019F23E5AF0F0266CD78A5F3D3290E5B", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\467a961d019f23e5af0f0266cd78a5f3d3290e5b", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\489059ED134C75D04357FD895C6280E1F7978C59", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\489059ed134c75d04357fd895c6280e1f7978c59", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\48D18A403364708B74676D0C5068809EE47BCF43", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\48d18a403364708b74676d0c5068809ee47bcf43", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\491836973BD7F16266314A8709EF00934A1BFCA0", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\491836973bd7f16266314a8709ef00934a1bfca0", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\491FFC0D1E910DC1DB3107E7DA730B43A97010A0", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\491ffc0d1e910dc1db3107e7da730b43a97010a0", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4A46AC76F0CCC4293CC380999116F3B7911F85BE", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4a46ac76f0ccc4293cc380999116f3b7911f85be", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4B18B5ADA8BF2E475961694931BE215AED8ECBD5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4b18b5ada8bf2e475961694931be215aed8ecbd5", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4B2A0DFA12FEADFF375261309F704B43534BEE37", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4b2a0dfa12feadff375261309f704b43534bee37", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4BB6AC032612F432B6B5DA43EE2DAA6A8A03B6F4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4bb6ac032612f432b6b5da43ee2daa6a8a03b6f4", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4C7EAEF07520B2C9900CFE06971368FF939AA197", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4c7eaef07520b2c9900cfe06971368ff939aa197", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\tmpAD23.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\tmpad23.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\nativecache\\read___me.html", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\nss8BF6.tmp\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nss8bf6.tmp\\read___me.html", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcookies\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\LocalState\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\localstate\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApiGroup\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapigroup\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapi\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\3Y24VK53\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\3y24vk53\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\eventbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\imprbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\eventbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\imprbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\eventbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\imprbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\eventbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\eventbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\imprbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\imprbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209809\\eventbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209809\\eventbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209809\\imprbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209809\\imprbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209776\\eventbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209776\\eventbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209776\\imprbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209776\\imprbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209562\\eventbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209562\\eventbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209562\\imprbeacons.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209562\\imprbeacons.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapi\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inetcookies\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inetcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcookies\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\AppCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\appcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\AppCache\\7CSZDG21\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\appcache\\7cszdg21\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DownloadHistory\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\downloadhistory\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DomainSuggestions\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\domainsuggestions\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DNTException\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\dntexception\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\ieflipaheadcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatuacache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\history\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\bingpagedatacache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\P1T4DCFU\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\p1t4dcfu\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\ETFMMWBM\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\etfmmwbm\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatuacache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\history\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\user\\default\\appcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\Y2EKXLK8\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\user\\default\\appcache\\y2ekxlk8\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\container.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\roaming.lock", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\roaming.lock", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\startupCache\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\startupcache\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat.log1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin.LOG1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin.log1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin.LOG2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin.log2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\3Y24VK53\\threshold[2].appcache", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\3y24vk53\\threshold[2].appcache", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\OfflineCache\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\offlinecache\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\Read___ME.html", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\read___me.html", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDC1500720033_en_US.msi", "hashes": [], "norm_filename": "c:\\program files (x86)\\adobe\\acrobat reader dc\\setup files\\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\\acrordrdc1500720033_en_us.msi", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\favorites.vssx..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8-smyN.jpg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\8-smyn.jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\AlternateServices.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\alternateservices.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\parent.lock..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\parent.lock..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SecurityPreloadState.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\securitypreloadstate.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\nativecache\\nativecache.directory..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\AdobeARM.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\adobearm.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\nss8BF6.tmp\\System.dll..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nss8bf6.tmp\\system.dll..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG2..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\roaming.lock..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\roaming.lock..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG2..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat.log2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\roaming.lock..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\roaming.lock..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG2..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat.log2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\roaming.lock..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\roaming.lock..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.LOG2..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat.log2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\roaming.lock..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\roaming.lock..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.LOG2..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat.log2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{17468BC4-3ACB-4D2A-98C2-B0B7B4EF29E6}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{17468bc4-3acb-4d2a-98c2-b0b7b4ef29e6}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{17cd9488-1228-4b2f-88ce-4298e93e0966}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{17cd9488-1228-4b2f-88ce-4298e93e0966}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1845AA13-3644-4FBC-B766-EEEF29683256}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1845aa13-3644-4fbc-b766-eeef29683256}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1928DA28-C5A7-4F13-AF81-8238D57A793F}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1928da28-c5a7-4f13-af81-8238d57a793f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1a4635ec-181d-45ae-b691-bc75bec02756}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1a4635ec-181d-45ae-b691-bc75bec02756}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1A5712E4-AAD7-4717-B22A-CF0B8438E2E6}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1a5712e4-aad7-4717-b22a-cf0b8438e2e6}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1BDB99DF-3832-49D6-9AE0-52105DB568DA}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1bdb99df-3832-49d6-9ae0-52105db568da}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1DD03EE3-FC46-456A-8632-B0717A9D497D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1dd03ee3-fc46-456a-8632-b0717a9d497d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{201CEF4B-7444-4B2F-B885-5E8F0AA1D614}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{201cef4b-7444-4b2f-b885-5e8f0aa1d614}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{207D6BD2-A09B-406f-8A72-BC90C49FC152}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{207d6bd2-a09b-406f-8a72-bc90c49fc152}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{21A5437E-D266-4F56-A146-06744A8BC071}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{21a5437e-d266-4f56-a146-06744a8bc071}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{232A1851-808C-4B44-A92A-38E862989CE5}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{232a1851-808c-4b44-a92a-38e862989ce5}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{29B87534-19A8-4A39-AA81-2148E7DE5894}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{29b87534-19a8-4a39-aa81-2148e7de5894}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{2B6FE85A-C7AA-440F-B9A3-3F5EDCA3F6C2}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{2b6fe85a-c7aa-440f-b9a3-3f5edca3f6c2}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{2D06D17B-2A5F-4835-AF30-6D2D58A4A66C}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{2d06d17b-2a5f-4835-af30-6d2d58a4a66c}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{30137454-0E1F-43bb-9CB8-AEF452964B0B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{30137454-0e1f-43bb-9cb8-aef452964b0b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{31DD3DA1-ED44-4BA8-A67B-6EA93DEA77E7}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{31dd3da1-ed44-4ba8-a67b-6ea93dea77e7}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{33843DB0-24E7-4682-A019-5393D7F2BFFA}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{33843db0-24e7-4682-a019-5393d7f2bffa}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{33F1F9B5-BD94-4D77-96AE-62F10E4A010A}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{33f1f9b5-bd94-4d77-96ae-62f10e4a010a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{36C8B34B-83F9-4704-B817-9AB1A723705A}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{36c8b34b-83f9-4704-b817-9ab1a723705a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{36fb1658-3a23-4d62-9bfd-37f4b18a85e9}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{36fb1658-3a23-4d62-9bfd-37f4b18a85e9}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{37092408-D49C-451D-B56D-78B243DC475C}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{37092408-d49c-451d-b56d-78b243dc475c}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{37C361D8-51CD-40fa-A797-8FC1EA28F9F4}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{37c361d8-51cd-40fa-a797-8fc1ea28f9f4}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{37E2F32E-C821-4094-B429-2B4E8EA810AA}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{37e2f32e-c821-4094-b429-2b4e8ea810aa}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{38bd6d6e-bf78-4c31-b05a-7447ee37669f}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{38bd6d6e-bf78-4c31-b05a-7447ee37669f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3911D4F8-AD61-4911-A151-5682C26A7427}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{3911d4f8-ad61-4911-a151-5682c26a7427}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3A100872-EC27-46A5-BBCC-92C90635AE3B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{3a100872-ec27-46a5-bbcc-92c90635ae3b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3A4140C8-50D3-44E9-BF50-C878204DE0F5}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{3a4140c8-50d3-44e9-bf50-c878204de0f5}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3F0AD6DB-3246-48E4-ACD7-696FF62AE68D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{3f0ad6db-3246-48e4-acd7-696ff62ae68d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4026492f-2f69-46b8-b9bf-5654fc07e423}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{4026492f-2f69-46b8-b9bf-5654fc07e423}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{40419485-c444-4567-851a-2dd7bfa1684d}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{40419485-c444-4567-851a-2dd7bfa1684d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{420C524A-2A76-43F7-B1B2-C3CF736557C7}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{420c524a-2a76-43f7-b1b2-c3cf736557c7}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4228F99D-227F-4058-9EA3-BB2B616D7444}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{4228f99d-227f-4058-9ea3-bb2b616d7444}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{45FDB5DF-1457-4A41-A824-7AD9C75767BC}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{45fdb5df-1457-4a41-a824-7ad9c75767bc}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{46E84184-51CC-4A7B-A40A-6D3E86D402DE}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{46e84184-51cc-4a7b-a40a-6d3e86d402de}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4A2F952E-0618-467F-ADC5-FEBB66AEB82F}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{4a2f952e-0618-467f-adc5-febb66aeb82f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4BCD16D0-BA72-4F0D-88F9-50D912BFA2B2}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{4bcd16d0-ba72-4f0d-88f9-50d912bfa2b2}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4F9B0706-0A8F-45B0-BFA6-C66CD45246D7}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{4f9b0706-0a8f-45b0-bfa6-c66cd45246d7}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{50DF4F13-4188-49C3-B2FB-A76404DC0ACF}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{50df4f13-4188-49c3-b2fb-a76404dc0acf}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5163E94E-4C07-420B-B173-320232B8AFB7}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5163e94e-4c07-420b-b173-320232b8afb7}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{53440D79-CD2D-4013-B192-D478AE882E53}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{53440d79-cd2d-4013-b192-d478ae882e53}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{54692DB7-FC98-4D5E-AC15-CC5095FA5669}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{54692db7-fc98-4d5e-ac15-cc5095fa5669}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{54D8069E-E75A-4437-B45B-8EB3B8C97434}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{54d8069e-e75a-4437-b45b-8eb3b8c97434}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5530E8CC-1B9E-4798-A880-BA719ADFBBBD}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5530e8cc-1b9e-4798-a880-ba719adfbbbd}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{55E51B6E-7D17-4C80-859E-3007A1F2B6AA}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{55e51b6e-7d17-4c80-859e-3007a1f2b6aa}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{58e3c745-d971-4081-9034-86e34b30836a}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{58e3c745-d971-4081-9034-86e34b30836a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5902614C-D9C7-4902-9F7F-BAF85454D0B2}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5902614c-d9c7-4902-9f7f-baf85454d0b2}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5A2C0E5E-5974-4E44-B4C6-AD4C2B6BAF53}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5a2c0e5e-5974-4e44-b4c6-ad4c2b6baf53}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5BB16858-F647-465E-BCFD-010EE9DD41B7}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5bb16858-f647-465e-bcfd-010ee9dd41b7}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5D461B44-2753-4DD7-B2C0-BAB71B1F4C1A}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5d461b44-2753-4dd7-b2c0-bab71b1f4c1a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5D611F64-7985-459B-BDFF-AEC069CB2625}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5d611f64-7985-459b-bdff-aec069cb2625}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5DD91132-02E8-43F6-88BD-E50B7BE2EF29}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5dd91132-02e8-43f6-88bd-e50b7be2ef29}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5DE5B491-2CEA-4AD9-824A-982A22C0B64E}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5de5b491-2cea-4ad9-824a-982a22c0b64e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5ea4f148-308c-46d7-98a9-49041b1dd468}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5ea4f148-308c-46d7-98a9-49041b1dd468}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5FFAA809-0961-40CF-90A4-58037867FA50}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{5ffaa809-0961-40cf-90a4-58037867fa50}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{60AC7FA0-A928-4D45-B4DD-AC70A6175E67}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{60ac7fa0-a928-4d45-b4dd-ac70a6175e67}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{60C811E8-C857-404E-98BB-EE5D83C1DF5A}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{60c811e8-c857-404e-98bb-ee5d83c1df5a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{62d8ed13-c9d0-4ce8-a914-47dd628fb1b0}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{62d8ed13-c9d0-4ce8-a914-47dd628fb1b0}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{638f8e21-e157-40d7-97e0-a0c8e4c4e2b5}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{638f8e21-e157-40d7-97e0-a0c8e4c4e2b5}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{63929D0B-AAAC-4DCA-AE8A-222EC37F7A88}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{63929d0b-aaac-4dca-ae8a-222ec37f7a88}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{641102EF-6463-46E9-842D-176013D7ACC8}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{641102ef-6463-46e9-842d-176013d7acc8}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6775CCA4-CC42-44F7-800C-4E94FF1EA8C0}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6775cca4-cc42-44f7-800c-4e94ff1ea8c0}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{67ca7650-96e6-4fdd-bb43-a8e774f73a57}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{67ca7650-96e6-4fdd-bb43-a8e774f73a57}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\classic_{685e7dc2-db57-4ed0-8b6d-5fe44d78d4f0}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{685e7dc2-db57-4ed0-8b6d-5fe44d78d4f0}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{68F4F33C-658C-4278-94C1-22B8E653F3E8}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{68f4f33c-658c-4278-94c1-22b8e653f3e8}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{693E4EF4-9060-469B-AB2E-948B6B68A883}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{693e4ef4-9060-469b-ab2e-948b6b68a883}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{693E4EF5-9060-469B-AB2E-948B6B68A883}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{693e4ef5-9060-469b-ab2e-948b6b68a883}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6A10BC7B-2586-4B57-A5AA-C14BDE743DC4}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6a10bc7b-2586-4b57-a5aa-c14bde743dc4}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6AE88B06-50B2-46B0-93EA-4B5C73D3A0B5}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6ae88b06-50b2-46b0-93ea-4b5c73d3a0b5}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6CA1F1CE-1FED-4D96-A82E-08CEDB139AA3}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6ca1f1ce-1fed-4d96-a82e-08cedb139aa3}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6CBA2898-2EFE-4604-9933-F1F64DAE2A32}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6cba2898-2efe-4604-9933-f1f64dae2a32}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6dfd7c5c-2451-11d3-a299-00c04f8ef6af}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{6dfd7c5c-2451-11d3-a299-00c04f8ef6af}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{71D0780F-10D2-459C-983B-94A642161220}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{71d0780f-10d2-459c-983b-94a642161220}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{725be8f7-668e-4c7b-8f90-46bdb0936430}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{725be8f7-668e-4c7b-8f90-46bdb0936430}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{73C9C58C-2E01-4F68-B1B9-7A4DD2EF71F7}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{73c9c58c-2e01-4f68-b1b9-7a4dd2ef71f7}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7429F4F9-AE58-401a-82AD-723F3C6BDDD6}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7429f4f9-ae58-401a-82ad-723f3c6bddd6}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{75AC9145-7EC9-4883-82A7-AD3429020AA0}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{75ac9145-7ec9-4883-82a7-ad3429020aa0}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{76F31A78-3FDA-4F80-B015-95CFD81463AD}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{76f31a78-3fda-4f80-b015-95cfd81463ad}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7a4d0c5d-51ad-443e-87c7-66b757586c56}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7a4d0c5d-51ad-443e-87c7-66b757586c56}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7ABBE8E6-757F-419A-B2E0-07D5694F8E0F}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7abbe8e6-757f-419a-b2e0-07d5694f8e0f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7B086E4E-366C-454A-85CC-B8B533482B10}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7b086e4e-366c-454a-85cc-b8b533482b10}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7C3E0552-96E2-4069-AC1C-208C146683CA}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7c3e0552-96e2-4069-ac1c-208c146683ca}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7D13A5DB-6081-48BD-8EA3-A9D7FE67A335}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7d13a5db-6081-48bd-8ea3-a9d7fe67a335}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7DE6CF7C-B699-421B-A808-139E798E6C64}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7de6cf7c-b699-421b-a808-139e798e6c64}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7E5BC096-F558-419A-9326-BC6414D592C3}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7e5bc096-f558-419a-9326-bc6414d592c3}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7F8B6C83-2A89-47A0-B334-AA58D042CDEC}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{7f8b6c83-2a89-47a0-b334-aa58d042cdec}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8050502B-9B94-408C-BF49-D2D8887C1BCF}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8050502b-9b94-408c-bf49-d2d8887c1bcf}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{80f3f1d5-feca-45f3-bc32-752c152e456e}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{80f3f1d5-feca-45f3-bc32-752c152e456e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{821FB666-D307-4865-86BB-68725A30999C}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{821fb666-d307-4865-86bb-68725a30999c}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{84C9670E-825D-4128-B173-2963886C5A3E}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{84c9670e-825d-4128-b173-2963886c5a3e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8562B9B8-812D-420C-9189-DC216D788A49}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8562b9b8-812d-420c-9189-dc216d788a49}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{875FE7D6-5BDF-496F-B349-91E5E3625B86}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{875fe7d6-5bdf-496f-b349-91e5e3625b86}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8774b87d-a2b4-49a0-8237-bfefd00646c2}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8774b87d-a2b4-49a0-8237-bfefd00646c2}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{87842A7E-D784-458d-BEF4-CFDC632DCF3E}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{87842a7e-d784-458d-bef4-cfdc632dcf3e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{87d66a43-7b11-4a28-9811-c86ee395acf7}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{87d66a43-7b11-4a28-9811-c86ee395acf7}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{886EDAFC-1051-483F-8AE2-904087A7E580}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{886edafc-1051-483f-8ae2-904087a7e580}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{88C9D04D-39DD-41EE-A63B-23218D69717F}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{88c9d04d-39dd-41ee-a63b-23218d69717f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8902C92D-5AB7-433B-9065-3F55F8334E29}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8902c92d-5ab7-433b-9065-3f55f8334e29}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{895607E0-D0F9-48bd-B19E-96FBE9BBDCF9}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{895607e0-d0f9-48bd-b19e-96fbe9bbdcf9}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{89A2270D-DF2E-4172-8BA5-159D6AD00C15}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{89a2270d-df2e-4172-8ba5-159d6ad00c15}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8bb27ec5-5cb3-4781-baee-3439df4806e4}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8bb27ec5-5cb3-4781-baee-3439df4806e4}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8D58F804-9520-4208-A527-7C2B6CB77B33}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8d58f804-9520-4208-a527-7c2b6cb77b33}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8E0C279D-0BD1-43C3-9EBD-31C3DC5B8A77}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8e0c279d-0bd1-43c3-9ebd-31c3dc5b8a77}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8E21794E-9303-44C5-A493-C3DC53C0E463}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8e21794e-9303-44c5-a493-c3dc53c0e463}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8e908fc9-becc-40f6-915b-f4ca0e70d03d}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{8e908fc9-becc-40f6-915b-f4ca0e70d03d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{906435EC-336D-4B77-BCD6-397DE8318852}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{906435ec-336d-4b77-bcd6-397de8318852}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{907F262A-012A-4F6A-94C9-F479F3E6EE16}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{907f262a-012a-4f6a-94c9-f479f3e6ee16}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{90ab71ce-bab6-4ca2-84fe-629338405756}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{90ab71ce-bab6-4ca2-84fe-629338405756}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{91BA8E01-F854-4418-A108-E63323DDAE60}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{91ba8e01-f854-4418-a108-e63323ddae60}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9389633E-8BCB-4448-93CD-EBFFA0759257}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9389633e-8bcb-4448-93cd-ebffa0759257}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9430DB91-B966-4971-A955-E3DBA1F889E7}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9430db91-b966-4971-a955-e3dba1f889e7}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{944A41B9-C0FD-41AE-A6DF-5AC4FE5A59B4}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{944a41b9-c0fd-41ae-a6df-5ac4fe5a59b4}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{950fd00b-c4a9-4465-852a-b1eb51e2e7f6}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{950fd00b-c4a9-4465-852a-b1eb51e2e7f6}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{955E7FFD-4DD9-4124-96FC-86C3C653DD33}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{955e7ffd-4dd9-4124-96fc-86c3c653dd33}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{96BC4455-FDA3-4DE2-8B71-9D1953F0B32D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{96bc4455-fda3-4de2-8b71-9d1953f0b32d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{96DF8B78-8299-4BC1-B56B-6C375FBEC228}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{96df8b78-8299-4bc1-b56b-6c375fbec228}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9891D47B-7E37-4265-BAD2-1FA991543B90}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9891d47b-7e37-4265-bad2-1fa991543b90}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{98CCA0B9-CF6C-4FFD-98E1-87BFEDDD4D21}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{98cca0b9-cf6c-4ffd-98e1-87bfeddd4d21}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9B802EF5-59B7-4974-9022-06DC2A9B1677}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9b802ef5-59b7-4974-9022-06dc2a9b1677}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9BA8A9A5-F1C1-4F09-AE9A-EFEAA5961BE3}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9ba8a9a5-f1c1-4f09-ae9a-efeaa5961be3}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9C39057F-5CE5-4BAB-BE61-2957A12EEC52}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9c39057f-5ce5-4bab-be61-2957a12eec52}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9c60de1e-e5fc-40f4-a487-460851a8d915}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9c60de1e-e5fc-40f4-a487-460851a8d915}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9EF86966-2F35-49BE-A9F6-398E0B844411}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9ef86966-2f35-49be-a9f6-398e0b844411}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9fe63afd-59cf-4419-9775-abcc3849f861}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{9fe63afd-59cf-4419-9775-abcc3849f861}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{a0275511-0e86-4eca-97c2-ecd8f1221d08}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a0275511-0e86-4eca-97c2-ecd8f1221d08}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{A10DFF38-B2D2-44AC-952B-A2B5DC5D0C9F}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a10dff38-b2d2-44ac-952b-a2b5dc5d0c9f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{a3dd4f92-658a-410f-84fd-6fbbbef2fffe}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a3dd4f92-658a-410f-84fd-6fbbbef2fffe}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{A42E8D99-83E6-4D12-B403-F46059D02CF0}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a42e8d99-83e6-4d12-b403-f46059d02cf0}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{A7160DE5-E591-4D98-9BB0-0CAC99D5F2D5}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a7160de5-e591-4d98-9bb0-0cac99d5f2d5}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{A73DCDB5-E233-4FC2-8083-6E431939002A}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a73dcdb5-e233-4fc2-8083-6e431939002a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{a8a91a66-3a7d-4424-8d24-04e180695c7a}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{a8a91a66-3a7d-4424-8d24-04e180695c7a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AA9D2032-E8FB-4f8c-99C9-09F539AEBD59}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{aa9d2032-e8fb-4f8c-99c9-09f539aebd59}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AACA901F-E74F-4894-B074-F55059532853}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{aaca901f-e74f-4894-b074-f55059532853}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AAF384A9-978C-41B6-B394-0C40C2EAAA4B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{aaf384a9-978c-41b6-b394-0c40c2eaaa4b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ABB4509D-9043-4EF2-8796-E4646ECF951D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{abb4509d-9043-4ef2-8796-e4646ecf951d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AF3BA0EC-B240-401E-B4EE-3E89F275205B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{af3ba0ec-b240-401e-b4ee-3e89f275205b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B0B4886C-4B31-4824-ADCD-0DAF5C8BAFF6}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b0b4886c-4b31-4824-adcd-0daf5c8baff6}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B1207959-FFBF-4417-A6B1-4BF0EDA51F5A}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b1207959-ffbf-4417-a6b1-4bf0eda51f5a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B123B0AB-2E4E-4325-804A-32F99784DA0B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b123b0ab-2e4e-4325-804a-32f99784da0b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B1FE5142-DEDD-409B-BCC8-547EC08DE84E}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b1fe5142-dedd-409b-bcc8-547ec08de84e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{b2c761c6-29bc-4f19-9251-e6195265baf1}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b2c761c6-29bc-4f19-9251-e6195265baf1}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B3C577FA-7C51-4259-A1C4-088BD0B0932E}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b3c577fa-7c51-4259-a1c4-088bd0b0932e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B6B2793F-F4B9-49FD-B578-212C3C020892}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b6b2793f-f4b9-49fd-b578-212c3c020892}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B7622F10-9A47-4BF2-B6EF-2C20B4510254}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b7622f10-9a47-4bf2-b6ef-2c20b4510254}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B896819B-CF73-4da0-8F59-6E744A6BCD5F}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b896819b-cf73-4da0-8f59-6e744a6bcd5f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B935C3B6-969C-4FC2-B96C-7F06794471AF}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b935c3b6-969c-4fc2-b96c-7f06794471af}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B98AD935-426A-482B-9383-ED7D8BB99A6F}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{b98ad935-426a-482b-9383-ed7d8bb99a6f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{BABB24A6-0242-4AE5-BD83-C5816526F63D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{babb24a6-0242-4ae5-bd83-c5816526f63d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bb06c0e4-d293-4f75-8a90-cb05b6477eee}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bb06c0e4-d293-4f75-8a90-cb05b6477eee}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bb64f8a7-bee7-4e1a-ab8d-7d8273f7fdb6}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bb64f8a7-bee7-4e1a-ab8d-7d8273f7fdb6}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{BD256B65-94BE-4194-84BF-41D50D0EF26E}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bd256b65-94be-4194-84bf-41d50d0ef26e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bd84b380-8ca2-1069-ab1d-08000948f534}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bd84b380-8ca2-1069-ab1d-08000948f534}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{be122a0e-4503-11da-8bde-f66bad1e3f3a}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{be122a0e-4503-11da-8bde-f66bad1e3f3a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{BEC9E135-14C1-4e00-B5C8-899F26833A5A}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bec9e135-14c1-4e00-b5c8-899f26833a5a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bf782cc9-5a52-4a17-806c-2a894ffeeac5}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{bf782cc9-5a52-4a17-806c-2a894ffeeac5}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C16A18A2-DC4F-4B7D-92F1-14C430AD17DC}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c16a18a2-dc4f-4b7d-92f1-14c430ad17dc}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C3915CF9-A3D9-4EFD-B209-62C05793EE0F}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c3915cf9-a3d9-4efd-b209-62c05793ee0f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C3F521C1-249F-48FD-9D9D-731EA4568776}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c3f521c1-249f-48fd-9d9d-731ea4568776}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C5361E07-6AA3-4453-81BC-93E8F85EABED}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c5361e07-6aa3-4453-81bc-93e8f85eabed}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{c555438b-3c23-4769-a71f-b6d3d9b6053a}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c555438b-3c23-4769-a71f-b6d3d9b6053a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{c58c4893-3be0-4b45-abb5-a63e4b8c8651}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c58c4893-3be0-4b45-abb5-a63e4b8c8651}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C5AE651D-D027-4D11-8125-595B9933C78B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c5ae651d-d027-4d11-8125-595b9933c78b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C7C81DAD-835C-45B0-9632-60F3EB5D55AC}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c7c81dad-835c-45b0-9632-60f3eb5d55ac}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C86B1923-8E1F-414B-83DB-94B09BA73E15}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{c86b1923-8e1f-414b-83db-94b09ba73e15}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CD2A5953-36A2-427D-B762-3610F37A5D89}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{cd2a5953-36a2-427d-b762-3610f37a5d89}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CD95D0E3-6B3A-495B-9FDA-57FAD586304D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{cd95d0e3-6b3a-495b-9fda-57fad586304d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CE4F7091-EEC0-400E-A019-38503D525293}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ce4f7091-eec0-400e-a019-38503d525293}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CF081448-68EC-4969-9F8B-BB23B329B712}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{cf081448-68ec-4969-9f8b-bb23b329b712}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d17d1d6d-cc3f-4815-8fe3-607e7d5d10b3}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d17d1d6d-cc3f-4815-8fe3-607e7d5d10b3}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D1AF7F5F-18C1-4143-81E5-EDAF02255883}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d1af7f5f-18c1-4143-81e5-edaf02255883}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d20ea4e1-3957-11d2-a40b-0c5020524153}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d20ea4e1-3957-11d2-a40b-0c5020524153}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D4690CFE-6A59-4BAB-BFF7-9ED0D083E798}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d4690cfe-6a59-4bab-bff7-9ed0d083e798}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d555645e-d4f8-4c29-a827-d93c859c4f2a}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d555645e-d4f8-4c29-a827-d93c859c4f2a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D5BAC999-E706-4311-9DB0-86E117B1FD25}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d5bac999-e706-4311-9db0-86e117b1fd25}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D5D5B38A-0FD8-43B6-8C7D-372D84BD357D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d5d5b38a-0fd8-43b6-8c7d-372d84bd357d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D652F9E4-08FD-4A24-8EAC-05715188233E}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d652f9e4-08fd-4a24-8eac-05715188233e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D679D992-D843-4D3C-BFEA-5EDF4D37EE9F}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d679d992-d843-4d3c-bfea-5edf4d37ee9f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D825FEC7-DA3D-456A-BEF2-20F07BA0449E}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d825fec7-da3d-456a-bef2-20f07ba0449e}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D995F7E9-727D-4AD6-83F3-A4A753965A8F}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d995f7e9-727d-4ad6-83f3-a4a753965a8f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d9ef8727-cac2-4e60-809e-86f80a666c91}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{d9ef8727-cac2-4e60-809e-86f80a666c91}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{da9f1e02-aa94-40bf-b3cd-030231a10acc}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{da9f1e02-aa94-40bf-b3cd-030231a10acc}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DAF32862-EF3D-4D61-AB92-47AEB51DDC80}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{daf32862-ef3d-4d61-ab92-47aeb51ddc80}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DD338333-7000-45CC-A84D-64680D6E683D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{dd338333-7000-45cc-a84d-64680d6e683d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DDF23EF5-6677-42C1-92CB-29BDCB7375B8}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ddf23ef5-6677-42c1-92cb-29bdcb7375b8}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DF7B19EF-DEA5-47D7-BBA5-9FCBE400A59D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{df7b19ef-dea5-47d7-bba5-9fcbe400a59d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E00117F3-53BA-4E06-B9BF-B8E22A1469E6}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e00117f3-53ba-4e06-b9bf-b8e22a1469e6}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E07F215A-6022-40E0-A109-17078992E5F9}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e07f215a-6022-40e0-a109-17078992e5f9}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E2394C16-F45A-496F-83CC-49E163281662}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e2394c16-f45a-496f-83cc-49e163281662}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{e2e7934b-dce5-43c4-9576-7fe4f75e7480}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e2e7934b-dce5-43c4-9576-7fe4f75e7480}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E4B554C8-B067-4540-A478-0565BB1F76B9}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e4b554c8-b067-4540-a478-0565bb1f76b9}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E6243488-3449-4D4D-98AA-FFC14E3FF0F8}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e6243488-3449-4d4d-98aa-ffc14e3ff0f8}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E79BCB1B-EEB7-4180-98FD-BD47F6DCFF79}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e79bcb1b-eeb7-4180-98fd-bd47f6dcff79}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{e9950154-c418-419e-a90a-20c5287ae24b}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e9950154-c418-419e-a90a-20c5287ae24b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E9C71548-B580-43B2-ACDB-1BA924002754}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{e9c71548-b580-43b2-acdb-1ba924002754}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EBEC2956-F512-474D-8631-9E753CC40653}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ebec2956-f512-474d-8631-9e753cc40653}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ecdb0924-4208-451e-8ee0-373c0956de16}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ecdb0924-4208-451e-8ee0-373c0956de16}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ED0FF627-BFD1-4F68-9A74-974E73F41A3A}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ed0ff627-bfd1-4f68-9a74-974e73f41a3a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ed834ed6-4b5a-4bfe-8f11-a626dcb6a921}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ed834ed6-4b5a-4bfe-8f11-a626dcb6a921}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EE423D17-7ED8-4B33-9555-C23DEEAFB4B6}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ee423d17-7ed8-4b33-9555-c23deeafb4b6}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EE439E7E-CE1E-4ABE-9EA8-50F12ED01FE0}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ee439e7e-ce1e-4abe-9ea8-50f12ed01fe0}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EF462183-352B-4DCF-811C-07FA7CFCD5AC}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ef462183-352b-4dcf-811c-07fa7cfcd5ac}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EF8F379B-747B-4C8E-B3D1-4A29E6CF45AE}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ef8f379b-747b-4c8e-b3d1-4a29e6cf45ae}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EFACECBA-BCCD-468B-BAB3-7CA40A898982}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{efacecba-bccd-468b-bab3-7ca40a898982}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F025B6FD-D1CA-4a32-9BEB-DBEF1D2F6926}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f025b6fd-d1ca-4a32-9beb-dbef1d2f6926}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F0E02D62-6C1D-4eb3-AC47-F8401425C6BC}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f0e02d62-6c1d-4eb3-ac47-f8401425c6bc}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F120B10E-C882-4613-955F-B4DF13C6E803}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f120b10e-c882-4613-955f-b4df13c6e803}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f2ddfc82-8f12-4cdd-b7dc-d4fe1425aa4d}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f2ddfc82-8f12-4cdd-b7dc-d4fe1425aa4d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F2E71049-6F88-4A3B-9475-5A2B40B36092}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f2e71049-6f88-4a3b-9475-5a2b40b36092}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F3FD1F8E-B34A-49AE-95B9-5DBEAB5BFB49}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f3fd1f8e-b34a-49ae-95b9-5dbeab5bfb49}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f56fbb39-e6d9-4b6d-9c29-ae82cff2925f}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f56fbb39-e6d9-4b6d-9c29-ae82cff2925f}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f6b6e965-e9b2-444b-9286-10c9152edbc5}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f6b6e965-e9b2-444b-9286-10c9152edbc5}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f82df8f7-8b9f-442e-a48c-818ea735ff9b}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f82df8f7-8b9f-442e-a48c-818ea735ff9b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F96E2F30-2018-4F0E-BBEE-7CCBEE8CE714}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{f96e2f30-2018-4f0e-bbee-7ccbee8ce714}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FADA4BFB-4853-4547-B70F-1B565E7D907B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{fada4bfb-4853-4547-b70f-1b565e7d907b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FD4FB8FA-F752-4E78-933B-8969E18BC9B5}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{fd4fb8fa-f752-4e78-933b-8969e18bc9b5}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FE777427-D33C-485B-A414-3BD5A2943162}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{fe777427-d33c-485b-a414-3bd5a2943162}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FEBB9292-6110-4B9E-8565-91C4076E0A43}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{febb9292-6110-4b9e-8565-91c4076e0a43}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FEFF8F5D-EB40-485d-AC2A-EB7942DDF624}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{feff8f5d-eb40-485d-ac2a-eb7942ddf624}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FFA33B6C-DC4D-438C-893F-EBF44A09BFC0}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{ffa33b6c-dc4d-438c-893f-ebf44a09bfc0}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\ControlPanel.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\controlpanel.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\CortanaSettings.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\cortanasettings.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_0_FlashPlayerCPLApp.cpl.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_0_flashplayercplapp.cpl.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{025A5937-A6BE-4686-A844-36FE4BEC8B6D}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{025a5937-a6be-4686-a844-36fe4bec8b6d}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{60632754-c523-4b62-b45c-4172da012619}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{60632754-c523-4b62-b45c-4172da012619}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{6C8EEC18-8D75-41B2-A177-8831D59D2D50}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{6c8eec18-8d75-41b2-a177-8831d59d2d50}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{7b81be6a-ce2b-4676-a29e-eb907a5126c5}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{7b81be6a-ce2b-4676-a29e-eb907a5126c5}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{96AE8D84-A250-4520-95A5-A47A7E3C548B}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{96ae8d84-a250-4520-95a5-a47a7e3c548b}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{b98a2bea-7d42-4558-8bd1-832f41bac6fd}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{d8559eb9-20c0-410e-beda-7ed416aecc2a}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{F942C606-0914-47AB-BE56-1321B8035096}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\namespace_classic_{f942c606-0914-47ab-be56-1321b8035096}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\SettingsPane_{4B719A8A-CE18-4033-BE59-1083B40F25B7}.settingcontent-ms..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\settingspane_{4b719a8a-ce18-4033-be59-1083b40f25b7}.settingcontent-ms..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\LocalState\\_sessionState.xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\localstate\\_sessionstate.xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-wal..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-wal..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppTracing_BGTask.etl..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\photosapptracing_bgtask.etl..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppTracing_BGTask.last.etl..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\photosapptracing_bgtask.last.etl..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.chk..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00037.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00037.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00038.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00038.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00039.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00039.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003A.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003a.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003B.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003b.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003C.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003c.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00001.jrs..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbres00001.jrs..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00002.jrs..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbres00002.jrs..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\EJEHAMU5.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\ejehamu5.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\LVKKMMVN.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\lvkkmmvn.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\MSIMGSIZ.DAT..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\msimgsiz.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\apps.18396.9007199266244209.fa7ca9c1-d3a4-4eac-8c88-d73453e5d352[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\apps.18396.9007199266244209.fa7ca9c1-d3a4-4eac-8c88-d73453e5d352[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\apps.28613.9007199266247640.e66db940-c7c0-4b3c-8b72-fc5046092266[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\apps.28613.9007199266247640.e66db940-c7c0-4b3c-8b72-fc5046092266[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\apps.40721.13510798885083716.d6e04241-8ff4-41b0-a3a3-43b1ced6a08f[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\apps.40721.13510798885083716.d6e04241-8ff4-41b0-a3a3-43b1ced6a08f[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\apps.48711.9007199266245096.7eed2a71-671f-4c26-9d68-6141c842f285[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\apps.48711.9007199266245096.7eed2a71-671f-4c26-9d68-6141c842f285[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\apps.55454.9007199266251611.8dc5de70-2b9f-4603-9d21-3f915579a269[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\apps.55454.9007199266251611.8dc5de70-2b9f-4603-9d21-3f915579a269[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\zinc[1].htm..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\zinc[1].htm..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\P4DH426Z\\zinc[2].htm..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\p4dh426z\\zinc[2].htm..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\0a5c1b58[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\0a5c1b58[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\2dd47e28[2].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\2dd47e28[2].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\apps.18578.9007199266246289.6f80413a-747a-465c-b810-b44f77d3084f[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\apps.18578.9007199266246289.6f80413a-747a-465c-b810-b44f77d3084f[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\apps.4100.9007199266251606.ae3c4a65-bf6f-4459-94e4-f5be923c9a5f[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\apps.4100.9007199266251606.ae3c4a65-bf6f-4459-94e4-f5be923c9a5f[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\apps.46520.13510798887155710.5365405a-2cb4-48a2-a90e-8ae898fcabf1[1].jpg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\apps.46520.13510798887155710.5365405a-2cb4-48a2-a90e-8ae898fcabf1[1].jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\apps.58775.9007199266677760.2c69fa74-238e-4e64-af60-87ffbeed7326[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\apps.58775.9007199266677760.2c69fa74-238e-4e64-af60-87ffbeed7326[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\FQWYA9OY\\f18fc33f[1].css..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\fqwya9oy\\f18fc33f[1].css..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\3Y24VK53\\apps.40361.9007199266251851.16146db2-5f86-4fcc-852d-95bf0325db35[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\3y24vk53\\apps.40361.9007199266251851.16146db2-5f86-4fcc-852d-95bf0325db35[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\3Y24VK53\\e6e099c1[1].css..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\3y24vk53\\e6e099c1[1].css..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\3Y24VK53\\th[1].jpg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\3y24vk53\\th[1].jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\3Y24VK53\\th[2].jpg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\3y24vk53\\th[2].jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\apps.15191.9007199266251530.cc19d652-3ab6-4535-a2c7-c576698c252d[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\apps.15191.9007199266251530.cc19d652-3ab6-4535-a2c7-c576698c252d[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\apps.24307.9007199266288952.82b35dd7-0a28-4339-a027-0c1d7303f65b[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\apps.24307.9007199266288952.82b35dd7-0a28-4339-a027-0c1d7303f65b[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\apps.4415.9007199266394310.e7a8b9d9-3bd7-4aed-98a9-eb467c12dfda[1].png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\apps.4415.9007199266394310.e7a8b9d9-3bd7-4aed-98a9-eb467c12dfda[1].png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\e8bd5198[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\e8bd5198[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\th[1].jpg..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\th[1].jpg..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\1N9MAX5B\\zinc[1].htm..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\1n9max5b\\zinc[1].htm..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\appcache[1].man..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\appcache[1].man..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\appcache[1].man..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\appcache[1].man..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\17bd1fca[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\17bd1fca[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\1acd62c3[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\1acd62c3[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\284df389[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\284df389[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3775eb01[1].css..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3775eb01[1].css..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3e533cad[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3e533cad[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\4c68d3b2[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\4c68d3b2[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\74843a82[1].css..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\74843a82[1].css..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\85441a2e[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\85441a2e[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\916eb510[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\916eb510[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\932ee198[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\932ee198[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\a137b088[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\a137b088[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\appcache[1].man..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\appcache[1].man..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\b99bbd2f[1].css..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\b99bbd2f[1].css..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\c71b7416[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\c71b7416[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\ca2ffdc0[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\ca2ffdc0[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\ce6a624f[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\ce6a624f[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e4709542[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e4709542[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e48237f6[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e48237f6[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e994e448[1].css..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e994e448[1].css..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\f544a93b[1].css..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\f544a93b[1].css..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\appcache[1].man..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\appcache[1].man..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\1500601998..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\1500601998..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\001107b94f5293b397165f26d15a256e62b7d4a8a9228f3093ac37da2be5b24f..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\001107b94f5293b397165f26d15a256e62b7d4a8a9228f3093ac37da2be5b24f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2bed4133f7a5cd078ac3c621dfa8e6362121ce0928c026612a1f1ddf4f99a370..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2bed4133f7a5cd078ac3c621dfa8e6362121ce0928c026612a1f1ddf4f99a370..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2d8669052d2b7df8dd4b9607f2379c68aea752aafe0def6d5ce226264835a7ca..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2d8669052d2b7df8dd4b9607f2379c68aea752aafe0def6d5ce226264835a7ca..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3a53c604f9aa7fa34010083e9e398486423e851c704b4d50043aaf2a8574d9b2..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3a53c604f9aa7fa34010083e9e398486423e851c704b4d50043aaf2a8574d9b2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3a65241e49133a96904d70724844acb053dc753d3ab27f93e89f8059cbccdb92..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3a65241e49133a96904d70724844acb053dc753d3ab27f93e89f8059cbccdb92..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\440989d816ce3a311a914b13a22ba992f95690849d761ffa5caab5959db0c921..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\440989d816ce3a311a914b13a22ba992f95690849d761ffa5caab5959db0c921..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\7053f8c6068c46e40f1016f56c5a556103340ef5fe7752801b7744069ae0f861..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\7053f8c6068c46e40f1016f56c5a556103340ef5fe7752801b7744069ae0f861..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8567d7efc6dd43319b076ebebb98cc2abd2520838a9ebd41597e4052b4bd2a22..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8567d7efc6dd43319b076ebebb98cc2abd2520838a9ebd41597e4052b4bd2a22..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\86f03f60d39829e5fba5aa195da9eedb1ad88e99410bf7fa169d1558aaf35bdd..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\86f03f60d39829e5fba5aa195da9eedb1ad88e99410bf7fa169d1558aaf35bdd..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\91dd86d2e068177d1504451bc4f923d177183c305ba3a521ebe87a3ca889ed90..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\91dd86d2e068177d1504451bc4f923d177183c305ba3a521ebe87a3ca889ed90..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\d6f3a2f0c0f5d4ad6cab70713323cac7710e91ff13667b2200b6b800881ac10f..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\d6f3a2f0c0f5d4ad6cab70713323cac7710e91ff13667b2200b6b800881ac10f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\f7df316937e894c20be9f8a6fc118847e60ea2dfe33cc1924f24346307e2b268..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\f7df316937e894c20be9f8a6fc118847e60ea2dfe33cc1924f24346307e2b268..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.chk..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.chk..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbres00001.jrs..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbres00001.jrs..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbres00002.jrs..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbres00002.jrs..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbtmp.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DomainSuggestions\\en-US.1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\domainsuggestions\\en-us.1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\edb.chk..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\edb.chk..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbres00001.jrs..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbres00001.jrs..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbres00002.jrs..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbres00002.jrs..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbtmp.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\P1T4DCFU\\www.msn[1].xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\p1t4dcfu\\www.msn[1].xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\ETFMMWBM\\www.bing[1].xml..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\etfmmwbm\\www.bing[1].xml..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\appcache[1].man..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\appcache[1].man..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Init[1].htm..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\init[1].htm..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51TU1403.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51tu1403.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5GJKP08H.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5gjkp08h.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\6NQ9V8CD.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\6nq9v8cd.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\JZ1UUUP9.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\jz1uuup9.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\KW0ULAFV.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\kw0ulafv.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\SW6Z4AI1.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\sw6z4ai1.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\TU6XBKFE.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\tu6xbkfe.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\U9PT9V3Q.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\u9pt9v3q.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\msimgsiz.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1zja02jo.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\268tpjia.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\6kwa3r8c.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\85dgk2j5.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fpndv7t3.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\j9kflzdx.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jn00akv9.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\or8k8vrm.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\tk0lxhbl.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vc62gjsf.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vsmdvd55.txt..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\settings.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.LOG1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.log1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\postSigningData..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\postsigningdata..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\directoryLinks.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\directorylinks.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\frequencyCap.json..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\frequencycap.json..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\_CACHE_CLEAN_..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\_cache_clean_..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\startupCache\\startupCache.4.little..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\startupcache\\startupcache.4.little..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\base-track-digest256.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\base-track-digest256.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\base-track-digest256.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\base-track-digest256.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-badbinurl-shavar.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-badbinurl-shavar.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-badbinurl-shavar.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-badbinurl-shavar.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-downloadwhite-digest256.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-downloadwhite-digest256.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-malware-shavar.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-malware-shavar.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-malware-shavar.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-malware-shavar.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-phish-shavar.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-phish-shavar.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-phish-shavar.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-phish-shavar.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-unwanted-shavar.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-unwanted-shavar.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\goog-unwanted-shavar.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\goog-unwanted-shavar.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\mozplugin-block-digest256.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\mozplugin-block-digest256.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\mozplugin-block-digest256.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\mozplugin-block-digest256.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\mozstd-trackwhite-digest256.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\mozstd-trackwhite-digest256.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-block-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-block-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-block-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-block-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flash-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flash-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flash-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flash-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flashallow-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flashallow-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flashallow-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flashallow-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flashsubdoc-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flashsubdoc-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-flashsubdoc-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-flashsubdoc-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-malware-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-malware-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-malware-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-malware-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-phish-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-phish-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-phish-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-phish-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-track-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-track-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-track-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-track-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-trackwhite-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-trackwhite-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-trackwhite-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-trackwhite-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-unwanted-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-unwanted-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\test-unwanted-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\test-unwanted-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flash-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flash-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flash-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flash-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashallow-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashallow-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashallow-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashallow-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\OfflineCache\\index.sqlite..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\offlinecache\\index.sqlite..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\4mkHR_p+Wn_2AEZoGYTTQQ==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\4mkhr_p+wn_2aezogyttqq==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\asRZLAIfRhwB7KZygffeFA==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\asrzlaifrhwb7kzygffefa==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\d+wy3cvuncc3wva6du1bzg==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\DiktK+QHhLcJqWKZ9_VsTA==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\diktk+qhhlcjqwkz9_vsta==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\dLcXOMhmEiiUNPBG1nL8Ew==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\dlcxomhmeiiunpbg1nl8ew==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\GNtk5OH7OPlVUCH7Ue1nuw==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\gntk5oh7oplvuch7ue1nuw==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\iNtr8V5+A8pq96nV92I9rg==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\intr8v5+a8pq96nv92i9rg==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KMkld2mykTtwKDykdZ4gNA==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kmkld2mykttwkdykdz4gna==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KykeNQT8cz0GP+hqz5mIpw==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kykenqt8cz0gp+hqz5mipw==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\kZbAJfgDibZzMvDTka320Q==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kzbajfgdibzzmvdtka320q==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\K_jbA2CUeAAOJVMrlKk+gQ==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\k_jba2cueaaojvmrlkk+gq==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\mgDer72BXyCa3ilaVifttQ==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\mgder72bxyca3ilavifttq==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\obXqSkYxtPxKEzhnvwJwjg==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\obxqskyxtpxkezhnvwjwjg==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\ttwZSCROfkViyTVqAFLXrw==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\ttwzscrofkviytvqaflxrw==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\XUMtyI1WhW2H+uz6m0iFOw==.ico..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\xumtyi1whw2h+uz6m0ifow==.ico..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index.log..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index.log..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\00230E843D3A08B230E933E226DB601D643BC852..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\00230e843d3a08b230e933e226db601d643bc852..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\00396519A728CAF55BA5985F2822E3CD29D0B17E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\00396519a728caf55ba5985f2822e3cd29d0b17e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0070686314FCF810B3CEE062939E2805C4894837..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0070686314fcf810b3cee062939e2805c4894837..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\01936D44B3D7F728EFEB4C28574EF44AB7260A17..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\01936d44b3d7f728efeb4c28574ef44ab7260a17..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\01CC9F4D43A947CA6202BA62A7FFF28C6881C1BF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\01cc9f4d43a947ca6202ba62a7fff28c6881c1bf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\01D69525274B61DE5FF860EF9BDF5BEDBB7E52C6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\01d69525274b61de5ff860ef9bdf5bedbb7e52c6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\023DB71E21A04D5A6CE60A1EC2C15A40BE00DD08..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\023db71e21a04d5a6ce60a1ec2c15a40be00dd08..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\02556929CF2E7913AF6E896368676F9BEC324DF4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\02556929cf2e7913af6e896368676f9bec324df4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\025E6C3190211A09D15D92E5656FB71220B7737E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\025e6c3190211a09d15d92e5656fb71220b7737e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0396D4FE028249B03B952ECAC5BDC2698D7AC41D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0396d4fe028249b03b952ecac5bdc2698d7ac41d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\04407A80544B9CDDB0BF74A9C5090D338DED55E6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\04407a80544b9cddb0bf74a9c5090d338ded55e6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\04825B72BD3FF3B25000EE8B3660F3E1748CF56D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\04825b72bd3ff3b25000ee8b3660f3e1748cf56d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\04DDA15772BB1EBE40F174D3D0AD961AB0D85881..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\04dda15772bb1ebe40f174d3d0ad961ab0d85881..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\04E42D40E9FF818034B152EBBD5D2648E474B06E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\04e42d40e9ff818034b152ebbd5d2648e474b06e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\053023C6ABE9799C7CBA3D16BB67C1B7F7B0D8A0..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\053023c6abe9799c7cba3d16bb67c1b7f7b0d8a0..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\062AD3657B516BAF21B6D366104D405078541BA6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\062ad3657b516baf21b6d366104d405078541ba6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\073B56D883E94B03370493A96DF99C2B51FB3E9D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\073b56d883e94b03370493a96df99c2b51fb3e9d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0782E7F698BE212FDCB80D8DE2C97C611AE50DFF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0782e7f698be212fdcb80d8de2c97c611ae50dff..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\085CFB45496B3087ABCB8ABD8529B3EB41D17C27..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\085cfb45496b3087abcb8abd8529b3eb41d17c27..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0A1144B8734850F5325AA6C259041EA8A201062C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0a1144b8734850f5325aa6c259041ea8a201062c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0A774848D5BE9E32A6789642784FD4DAFCD580F5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0a774848d5be9e32a6789642784fd4dafcd580f5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0A9B36C9F5BCA2621C56BD4B714A9141238CF27D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0a9b36c9f5bca2621c56bd4b714a9141238cf27d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0ADCF0E2A022CEDF8D199ED2889DB295128C4E25..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0adcf0e2a022cedf8d199ed2889db295128c4e25..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0B55D23F82EE119DC0472267436CD5F2868E3B14..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0b55d23f82ee119dc0472267436cd5f2868e3b14..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0BCD5C644E4A81783F24DB39416D1CE0CA0C3015..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0bcd5c644e4a81783f24db39416d1ce0ca0c3015..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0CFEB549E537F8B2151A62BA069AE7A6D363BB90..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0cfeb549e537f8b2151a62ba069ae7a6d363bb90..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0D1B36E62742C7776D68B1240296D02DFD6478FF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0d1b36e62742c7776d68b1240296d02dfd6478ff..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0D83D658A0C069047F6B9FD30BFDEDD80863B5F0..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0d83d658a0c069047f6b9fd30bfdedd80863b5f0..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0E030AE41B2AB97664B455929A8A0721BA5D1F69..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0e030ae41b2ab97664b455929a8a0721ba5d1f69..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0E331C2EF53B5C952B79B038C00588087D45A128..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0e331c2ef53b5c952b79b038c00588087d45a128..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0EC55DA246CC743C7EEA604EB85A206384B78D8F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0ec55da246cc743c7eea604eb85a206384b78d8f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0EFA10E4516ACC80858411CA65A3CFF2B1AB347D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0efa10e4516acc80858411ca65a3cff2b1ab347d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0FCD257674B1DEC53E0617114C11061F0395BE84..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0fcd257674b1dec53e0617114c11061f0395be84..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\0FEE7E531224DDC68090378EA0DD267E4A43A052..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\0fee7e531224ddc68090378ea0dd267e4a43a052..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\10242BACB3A923DC9924A5B41FC879A31AF03963..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\10242bacb3a923dc9924a5b41fc879a31af03963..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\102DC0B203B92AE5ADA25E34CEB5788226CA2769..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\102dc0b203b92ae5ada25e34ceb5788226ca2769..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\102E001FB34D784FBF727701C7932E3FC58AF45D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\102e001fb34d784fbf727701c7932e3fc58af45d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\108573E2B07FF25FFCAFE37F58D375561A47424D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\108573e2b07ff25ffcafe37f58d375561a47424d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\116D5E76041E1DFC3004D30FEEB76351BB9D361F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\116d5e76041e1dfc3004d30feeb76351bb9d361f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1355867C7C8ACB52152CDC249B64D742CC40340D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1355867c7c8acb52152cdc249b64d742cc40340d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1367E452AEFAA74CB544B69373FCCBB6C0E95AEB..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1367e452aefaa74cb544b69373fccbb6c0e95aeb..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1380A3F977C9CB8D60BD5A90243F6A04E42FAD04..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1380a3f977c9cb8d60bd5a90243f6a04e42fad04..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\13871F2088220BCD932D60C30C272709DEAABB04..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\13871f2088220bcd932d60c30c272709deaabb04..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1456D316BEE665C776E86DC63D0F546BA069BFBE..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1456d316bee665c776e86dc63d0f546ba069bfbe..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\14786BE4B1040FAE49EABD0E2222B7EDCC6DF321..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\14786be4b1040fae49eabd0e2222b7edcc6df321..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\14926D90946B0F4BA2FCA38D75A5FBA83EF29AD0..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\14926d90946b0f4ba2fca38d75a5fba83ef29ad0..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\14bf1b21a28d68d02d3cf7a0ca4d66159596ecd1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1531FBE50CE357526C558EE71AA60FC4D2E29E0C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1531fbe50ce357526c558ee71aa60fc4d2e29e0c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\15704E847DCFEC6E9A511A8897461209C820C052..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\15704e847dcfec6e9a511a8897461209c820c052..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\15E4224DA48B83948028AEBE08751418DBDE4688..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\15e4224da48b83948028aebe08751418dbde4688..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\16103553C2544720A8768AAA60212BE5916A4CE9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\16103553c2544720a8768aaa60212be5916a4ce9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\16114BA75206B6FA4C51ADC8A73DB4C6635F6AF9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\16114ba75206b6fa4c51adc8a73db4c6635f6af9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\165A82B735DDDE6F05E29A770A52297EAE982902..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\165a82b735ddde6f05e29a770a52297eae982902..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\16656B13E13FB159C452E606297943961E41BD83..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\16656b13e13fb159c452e606297943961e41bd83..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\167109A0C523F60F2197836B0BCDA9B52A4D16AE..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\167109a0c523f60f2197836b0bcda9b52a4d16ae..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\170F54EDBE19BE8676CC69B53BAC08C8932D118A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\170f54edbe19be8676cc69b53bac08c8932d118a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1722A63DF48E38B5DC308AE741FBFA24F762D8AC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1722a63df48e38b5dc308ae741fbfa24f762d8ac..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\17FDE78A9ACA4445D5D13C94208BC4B0E4BA046A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\17fde78a9aca4445d5d13c94208bc4b0e4ba046a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1801CFE5BC39C5B24721E8CB2F32854EF5C5F96A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1801cfe5bc39c5b24721e8cb2f32854ef5c5f96a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1833D74FE9FD5E002D12AD1D5CE9845C539E6D49..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1833d74fe9fd5e002d12ad1d5ce9845c539e6d49..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\19B6A58F54F979D1CF008970B9B0D36B11B7944D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\19b6a58f54f979d1cf008970b9b0d36b11b7944d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1A7C641FFE043BB811768257AF97546A0C7F3B55..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1a7c641ffe043bb811768257af97546a0c7f3b55..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1AA5AFB1639FED28192BC2781A550C89494CDF9A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1aa5afb1639fed28192bc2781a550c89494cdf9a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1ADEB94741EA84BB04219DA402BBC420B5512A2A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1adeb94741ea84bb04219da402bbc420b5512a2a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1C7A6CE17940A6C75210FA60C52339417DEDEEFA..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1c7a6ce17940a6c75210fa60c52339417dedeefa..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1C849477DE15B1F8F2245945F3F44468F58146DF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1c849477de15b1f8f2245945f3f44468f58146df..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1D719B3EE2A34A4E2DC9D0A4EAE1DF7948EA5A46..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1d719b3ee2a34a4e2dc9d0a4eae1df7948ea5a46..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1D8C7F5B73A4CD02E54F20A75B1FC29BE8E2EE8B..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1d8c7f5b73a4cd02e54f20a75b1fc29be8e2ee8b..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1D94118C6FBA173AC2CE7C335C3CB9B7365F1E90..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1d94118c6fba173ac2ce7c335c3cb9b7365f1e90..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1DBC56BBF48819D9CC9E96F72309A2D366DD1B72..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1dbc56bbf48819d9cc9e96f72309a2d366dd1b72..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1DCB6E830B5F6182674047BC07BE94E869A82DC1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1dcb6e830b5f6182674047bc07be94e869a82dc1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1e4c1de6d9bc3c738cb37d3d4e0cccdbdd4ec3e7..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1E654765DD4C0B7A97A94BA7430FF4F02539B4D4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1e654765dd4c0b7a97a94ba7430ff4f02539b4d4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1eb2e405e2b5aff18dbd87bbfb385eed242a1ab5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1F03C5BEB6690C5E65013ADC12747A8FB0266E74..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1f03c5beb6690c5e65013adc12747a8fb0266e74..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1F101A980B722E67F1FB3F0366EA9E520FB47D1B..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1f101a980b722e67f1fb3f0366ea9e520fb47d1b..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\1f58b2f46f6c2de8ff822405ac18a18128d0bbbc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\20343A86FB834223CC13D33560122837208F7563..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\20343a86fb834223cc13d33560122837208f7563..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\209D12DF1554481FBDC90931601991A892F798E7..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\209d12df1554481fbdc90931601991a892f798e7..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2118755562A693569EE2423CB1A2136CB8F1D9CC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2118755562a693569ee2423cb1a2136cb8f1d9cc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\212CB67D7B36A171AAF7F0B1E24E5ADC687ACDCF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\212cb67d7b36a171aaf7f0b1e24e5adc687acdcf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2144C082C2AC8FA4FB4863D9D3BE7E335DD2C91D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2144c082c2ac8fa4fb4863d9d3be7e335dd2c91d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\21870284BD46D6F21E756FF12837E26AC55D301D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\21870284bd46d6f21e756ff12837e26ac55d301d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\21B0E0F8C11507CB07A1BB82407F5AD646D80836..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\21b0e0f8c11507cb07a1bb82407f5ad646d80836..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\224A275AD09BE370F96D409F6AFE2904589080EC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\224a275ad09be370f96d409f6afe2904589080ec..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\225640F98EF31B52AB76CF756A5C3512E0BDE89B..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\225640f98ef31b52ab76cf756a5c3512e0bde89b..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\22777C6913A6B4768EE40D5F0103A93D8B477C3C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\22777c6913a6b4768ee40d5f0103a93d8b477c3c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\22B072DE2E829A9BBDD29C6C1005CBE946651C89..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\22b072de2e829a9bbdd29c6c1005cbe946651c89..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\22CA1C7BCD8AA6B0D991889ABE75C06CA1EBACD1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\22ca1c7bcd8aa6b0d991889abe75c06ca1ebacd1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\24073350A672357B47B2D1A937642146E80AA938..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\24073350a672357b47b2d1a937642146e80aa938..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2445FA966A09E6B22679F2707AA980BBEBBC3BA8..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2445fa966a09e6b22679f2707aa980bbebbc3ba8..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\245CEDA973B44C04325E8F3063F7596F9C88F120..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\245ceda973b44c04325e8f3063f7596f9c88f120..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2465113476A71563C2561E1A45DF343E04BFF787..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2465113476a71563c2561e1a45df343e04bff787..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\24be475a5c9ce3da33684dfdee6ac47bc9ba6de6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\24C5A11C7C55D609ED86B6E31E2C94301D075CB3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\24c5a11c7c55d609ed86b6e31e2c94301d075cb3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\24F9514653FD834D9D33E21B4C0AECB308550A9A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\24f9514653fd834d9d33e21b4c0aecb308550a9a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2530EF3224B6681D2B34ED5DB0B170C716EB1E39..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2530ef3224b6681d2b34ed5db0b170c716eb1e39..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2587F851FECE6E69F3B26E54EDE4E02BD3C1D496..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2587f851fece6e69f3b26e54ede4e02bd3c1d496..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2598a1cbb2ea6db15dff6382e5b17f41b01b4f0e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\25AFA0D28E7333EEE9F600A4A4F5B1C37A33789F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\25afa0d28e7333eee9f600a4a4f5b1c37a33789f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\26686166E96A3EBDAC2ED90D8F9B4ECD22BBB577..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\26686166e96a3ebdac2ed90d8f9b4ecd22bbb577..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\26926D1CDB0298F2781D6FAD532518F7C8B787DA..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\26926d1cdb0298f2781d6fad532518f7c8b787da..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\26C8D0872DE7292BC9C7F54426A5E887557300EA..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\26c8d0872de7292bc9c7f54426a5e887557300ea..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\26D5902E65F2EC88B7E5ED33E815A3FDBE18E10F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\26d5902e65f2ec88b7e5ed33e815a3fdbe18e10f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\270900E85767111BD4C54667E304A0B6656EA0A0..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\270900e85767111bd4c54667e304a0b6656ea0a0..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\273736E26CFF7795BE550BE3B37B1D4598946999..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\273736e26cff7795be550be3b37b1d4598946999..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\28380882022BE365EDE32586CD158C635B9BE8D1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\28380882022be365ede32586cd158c635b9be8d1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\28D18C8667B2E4C79E3CE2766CF075BBFA55C129..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\28d18c8667b2e4c79e3ce2766cf075bbfa55c129..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\28DAEEA417486B2D8FF609CC22C0244D45F802F7..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\28daeea417486b2d8ff609cc22c0244d45f802f7..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\291F29EF92755427DA03AB115BD92B68F34AB659..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\291f29ef92755427da03ab115bd92b68f34ab659..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\297135C089B3661F5AABB8E90985C6930164B685..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\297135c089b3661f5aabb8e90985c6930164b685..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2a650cb5032027b0ef79f4b9916c5d43eefedb3a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2A705BA174D08F119A903AD6AE391B16AE92D9FC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2a705ba174d08f119a903ad6ae391b16ae92d9fc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2aeea30e1abf20ce6edcd6534789a8a96595e87a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2B662789DFDD9C1308FF8ECD48E05F393053163C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2b662789dfdd9c1308ff8ecd48e05f393053163c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2C18FE48FBDBA136A5EC51C8B9D4382D2452C359..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2c18fe48fbdba136a5ec51c8b9d4382d2452c359..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2C40C733B84018F500F4F551FC53305A5971F05F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2c40c733b84018f500f4f551fc53305a5971f05f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2C5330B3725C70F20F4BC8A5385F696CC68B83C6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2c5330b3725c70f20f4bc8a5385f696cc68b83c6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2C706476EF0944CD159653F65034A1071345205C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2c706476ef0944cd159653f65034a1071345205c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2CCFCBE257B8F5BE4FEAF68C08171DAF22AEED89..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2ccfcbe257b8f5be4feaf68c08171daf22aeed89..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2D062CF6D6777E6BD7D9D53DBAB84CA6329C9727..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2d062cf6d6777e6bd7d9d53dbab84ca6329c9727..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2D693D07DD992FA2955C9EDE27FDA78487556E32..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2d693d07dd992fa2955c9ede27fda78487556e32..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2d7db1f2a5bbde7db3035cea82134d2cf20d58ae..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2E08CDAEE955A40889AC5877BE194C7EF12394A5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2e08cdaee955a40889ac5877be194c7ef12394a5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2E2D3BD78AAC7DD8EC8B5CA26C36A64A912EA68B..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2e2d3bd78aac7dd8ec8b5ca26c36a64a912ea68b..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2E78209F2BD7068695BB80AAE0D3E5F19A372BCA..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2e78209f2bd7068695bb80aae0d3e5f19a372bca..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2eaff2699fcee0edfef4ff824c07727f657b0d45..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2F0A7F5A4CF50FBAA8EC8FB9F3EBEF7461E5FA83..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2f0a7f5a4cf50fbaa8ec8fb9f3ebef7461e5fa83..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2FD2E2A71F89E3A92F68CB796207228217259289..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2fd2e2a71f89e3a92f68cb796207228217259289..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\2FEB6245AA212EA51F79468084964097925BD6D6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\2feb6245aa212ea51f79468084964097925bd6d6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\311C19847187CC20C5A8A21FA39C6639F5BBCF67..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\311c19847187cc20c5a8a21fa39c6639f5bbcf67..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\31220725946AC054F523C4029C40CA22A7A42621..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\31220725946ac054f523c4029c40ca22a7a42621..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\31592C8B017CA0508B5F0339E7E1EA46376F2D31..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\31592c8b017ca0508b5f0339e7e1ea46376f2d31..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\317E80FB14217F5F6E8EAB3C4982A166EBEDBC9C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\317e80fb14217f5f6e8eab3c4982a166ebedbc9c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3194BBD824DE5F4E0F44B99C71BB6C700199B487..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3194bbd824de5f4e0f44b99c71bb6c700199b487..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\31F8F1DF56894B1D3F2180DB7128624160D6FD5E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\31f8f1df56894b1d3f2180db7128624160d6fd5e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3221C03D33E21E6F8B41DB86EB7B6527177AD6F9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3221c03d33e21e6f8b41db86eb7b6527177ad6f9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\32AFE38EED991EA004851E7C968397C7D9EA501C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\32afe38eed991ea004851e7c968397c7d9ea501c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\32B6927A1EB46E83B230070265358A1C5B788D11..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\32b6927a1eb46e83b230070265358a1c5b788d11..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3313B622F3B9896C056CB0A1A534E4C91732E665..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3313b622f3b9896c056cb0a1a534e4c91732e665..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\338233A5FF4B5082E562A4B5BFBCDB2581DE81E6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\338233a5ff4b5082e562a4b5bfbcdb2581de81e6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\339A4E96E26DFFA4704F0AF081D2B85B12D03939..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\339a4e96e26dffa4704f0af081d2b85b12d03939..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\33A34037B96BD19CC90C0A382CEDF384EE052FCC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\33a34037b96bd19cc90c0a382cedf384ee052fcc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\33B10E2C53E1205B7527185F086F1BD9A39B07CD..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\33b10e2c53e1205b7527185f086f1bd9a39b07cd..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\33E49DB212B852799023F439D16990005F93C4F7..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\33e49db212b852799023f439d16990005f93c4f7..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\33E659B30B4E594B210633855AC841A47BB4BBB9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\33e659b30b4e594b210633855ac841a47bb4bbb9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\346330431993BC995E9F9C114FE39FD5B54EB7DF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\346330431993bc995e9f9c114fe39fd5b54eb7df..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\34CEF73D25CB0DE8A1CD86FB09EF24D17790BCA7..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\34cef73d25cb0de8a1cd86fb09ef24d17790bca7..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3502F57243FBD8F9D25E093A72D603074783A304..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3502f57243fbd8f9d25e093a72d603074783a304..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\356FCE9F932692DC643481DBA1ABEA937B629F58..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\356fce9f932692dc643481dba1abea937b629f58..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\35933C361338037A97583E92DA61C299851A9B4E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\35933c361338037a97583e92da61c299851a9b4e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\36A422C04312727A6116F45E357EDA80B3B4A6FD..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\36a422c04312727a6116f45e357eda80b3b4a6fd..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\36C5C19636CA8995D6ADCD176668444451854326..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\36c5c19636ca8995d6adcd176668444451854326..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\36DBE72541419953BE4A8BD61964782F4DBEDECF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\36dbe72541419953be4a8bd61964782f4dbedecf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\376ED25A1DE94F0D96E985E5D5CACFCFE3812131..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\376ed25a1de94f0d96e985e5d5cacfcfe3812131..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\37B0298825F693E093744779A7278E41F1419493..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\37b0298825f693e093744779a7278e41f1419493..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\37B4BC98C8FDD6283BE80C5CC385582FEF5D6747..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\37b4bc98c8fdd6283be80c5cc385582fef5d6747..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\37BC32B4B7033C1AB388018EC734B639086C814E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\37bc32b4b7033c1ab388018ec734b639086c814e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\383704E4BB07D527519A7352BA38B681C661FD8F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\383704e4bb07d527519a7352ba38b681c661fd8f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\38819CF0EDDF28F6C7AE4A62EA2DC0E07EA71115..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\38819cf0eddf28f6c7ae4a62ea2dc0e07ea71115..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\39CC8AA9054EC6244CA281EEA4BD937517E2861D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\39cc8aa9054ec6244ca281eea4bd937517e2861d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\39D606C35C00ADA6E9320E1F6431E5A33EB42182..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\39d606c35c00ada6e9320e1f6431e5a33eb42182..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3A554E4EFCC1FAD19E963D27B9A2BF73C9664268..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3a554e4efcc1fad19e963d27b9a2bf73c9664268..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3A6C331288F156E9A07E3EA398F3A8FAF0530D8F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3a6c331288f156e9a07e3ea398f3a8faf0530d8f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3B3EDC129FE6ED020C044AC637791DEC8B6B7603..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3b3edc129fe6ed020c044ac637791dec8b6b7603..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3D896079491CA68DD9BB6DB7E612C8DC74463279..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3d896079491ca68dd9bb6db7e612c8dc74463279..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3DE1033D1165F9D849E6DFD8566ABB9179DB1D0F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3de1033d1165f9d849e6dfd8566abb9179db1d0f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3E42820479FADF666581B0704FA4AF901AE0E045..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3e42820479fadf666581b0704fa4af901ae0e045..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3EA580E2FD537915B7084615630F0189274B1F60..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3ea580e2fd537915b7084615630f0189274b1f60..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3FAECD8F44CECB41F5586C0DC333275FC173593A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3faecd8f44cecb41f5586c0dc333275fc173593a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\3FB6DE7747DC1B658385638D277CF2D620D232E4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\3fb6de7747dc1b658385638d277cf2d620d232e4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\400E86363026A9AC2DCD2221C145C6370E3E8EDA..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\400e86363026a9ac2dcd2221c145c6370e3e8eda..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4030DFFE47D5B75257AA7A8C0A26B737E2F00FF3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4030dffe47d5b75257aa7a8c0a26b737e2f00ff3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\40645D76E586E360D63982B2D4525920F0CF3060..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\40645d76e586e360d63982b2d4525920f0cf3060..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\406839CA18775158E58D75B2837624917D7E685C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\406839ca18775158e58d75b2837624917d7e685c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\407eb4de353de3ad4e1a29f0e0e84f65c2ce6e3a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\41367369B0154D1D2566CC216318C71115E089A2..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\41367369b0154d1d2566cc216318c71115e089a2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4238786CB87B503754EE13346F30AE3FCE28174F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4238786cb87b503754ee13346f30ae3fce28174f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\425AB3A135AC92C5F7A29092F686A777B30A8C0A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\425ab3a135ac92c5f7a29092f686a777b30a8c0a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\42C23BB7242DFE074931A302B5BEB9B1D73B0BA5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\42c23bb7242dfe074931a302b5beb9b1d73b0ba5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\431BDCA04B51BE586DFCF48431166463879B3DBF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\431bdca04b51be586dfcf48431166463879b3dbf..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\434A5C8B5D0BEF67CEEB6076803A286CAE99C8C9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\434a5c8b5d0bef67ceeb6076803a286cae99c8c9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\43686105AC844B29A19E4AD788A5ABBD2714FC75..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\43686105ac844b29a19e4ad788a5abbd2714fc75..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\438AB448ED7FB7D99CB7CFAB433F9E19A475D0EF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\438ab448ed7fb7d99cb7cfab433f9e19a475d0ef..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\43A641B524487AFDAC7A8AF548EE196228BF6EAE..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\43a641b524487afdac7a8af548ee196228bf6eae..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\44437BAE601C72F5ED96953EAE92C527D4C2D46F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\44437bae601c72f5ed96953eae92c527d4c2d46f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4453CB40F54977CDF96034A3A658080FDA7E43FA..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4453cb40f54977cdf96034a3a658080fda7e43fa..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\445E695F447CA967C4DAE00C80034130290F80EA..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\445e695f447ca967c4dae00c80034130290f80ea..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\45A759AC8024EF1FCC5ECA005CEB9C4A4F78984E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\45a759ac8024ef1fcc5eca005ceb9c4a4f78984e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\45C64E5C2E9809667C5FC9F06FC42641326DF768..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\45c64e5c2e9809667c5fc9f06fc42641326df768..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4613B437E86D18E98F830433A5E6F7F9ABAF3693..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4613b437e86d18e98f830433a5e6f7f9abaf3693..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\467A961D019F23E5AF0F0266CD78A5F3D3290E5B..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\467a961d019f23e5af0f0266cd78a5f3d3290e5b..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\489059ED134C75D04357FD895C6280E1F7978C59..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\489059ed134c75d04357fd895c6280e1f7978c59..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\48D18A403364708B74676D0C5068809EE47BCF43..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\48d18a403364708b74676d0c5068809ee47bcf43..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\491836973BD7F16266314A8709EF00934A1BFCA0..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\491836973bd7f16266314a8709ef00934a1bfca0..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\491FFC0D1E910DC1DB3107E7DA730B43A97010A0..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\491ffc0d1e910dc1db3107e7da730b43a97010a0..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4A46AC76F0CCC4293CC380999116F3B7911F85BE..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4a46ac76f0ccc4293cc380999116f3b7911f85be..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4B18B5ADA8BF2E475961694931BE215AED8ECBD5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4b18b5ada8bf2e475961694931be215aed8ecbd5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4B2A0DFA12FEADFF375261309F704B43534BEE37..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4b2a0dfa12feadff375261309f704b43534bee37..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4BB6AC032612F432B6B5DA43EE2DAA6A8A03B6F4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4bb6ac032612f432b6b5da43ee2daa6a8a03b6f4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4C7EAEF07520B2C9900CFE06971368FF939AA197..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4c7eaef07520b2c9900cfe06971368ff939aa197..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4CAD791F9C35BB747A46BAC7BE30A1E3BC028262..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4cad791f9c35bb747a46bac7be30a1e3bc028262..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4CAD791F9C35BB747A46BAC7BE30A1E3BC028262", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4cad791f9c35bb747a46bac7be30a1e3bc028262", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4CF1AED5BBD3500653D8E2D1ACE09C58CF2D6182..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4cf1aed5bbd3500653d8e2d1ace09c58cf2d6182..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4CF1AED5BBD3500653D8E2D1ACE09C58CF2D6182", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4cf1aed5bbd3500653d8e2d1ace09c58cf2d6182", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4DCE88D30F65C9460CC26665BC0A65F3234FA3D4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4dce88d30f65c9460cc26665bc0a65f3234fa3d4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4DCE88D30F65C9460CC26665BC0A65F3234FA3D4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4dce88d30f65c9460cc26665bc0a65f3234fa3d4", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4DEBFBF420A31CFDD61418B1BE3ADB580389730E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4debfbf420a31cfdd61418b1be3adb580389730e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4DEBFBF420A31CFDD61418B1BE3ADB580389730E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4debfbf420a31cfdd61418b1be3adb580389730e", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4efb15999ee57edbfaadf69d6a31d8c6f90fe8dc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4efb15999ee57edbfaadf69d6a31d8c6f90fe8dc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4F0C54EEF677196E2899E5E79B4F3A906E46F926..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4f0c54eef677196e2899e5e79b4f3a906e46f926..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4F0C54EEF677196E2899E5E79B4F3A906E46F926", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4f0c54eef677196e2899e5e79b4f3a906e46f926", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4F21DDD23480F1D4FBA13115BADB18B9AD18D8B1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4f21ddd23480f1d4fba13115badb18b9ad18d8b1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4F21DDD23480F1D4FBA13115BADB18B9AD18D8B1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4f21ddd23480f1d4fba13115badb18b9ad18d8b1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4F372C9418B79051ABED288900CDF3D20C12F38C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4f372c9418b79051abed288900cdf3d20c12f38c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4F372C9418B79051ABED288900CDF3D20C12F38C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4f372c9418b79051abed288900cdf3d20c12f38c", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4f680e68b8c682b5d2540fa7be7b7f0d7521d9c9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4f680e68b8c682b5d2540fa7be7b7f0d7521d9c9", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4F78D1F2D9B48D34C6259CF59FD5E171B97EFB3A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4f78d1f2d9b48d34c6259cf59fd5e171b97efb3a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4F78D1F2D9B48D34C6259CF59FD5E171B97EFB3A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4f78d1f2d9b48d34c6259cf59fd5e171b97efb3a", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4FC872C4A3A8739207D005A676C19DAB518FA53B..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4fc872c4a3a8739207d005a676c19dab518fa53b..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\4FC872C4A3A8739207D005A676C19DAB518FA53B", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\4fc872c4a3a8739207d005a676c19dab518fa53b", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\514D7C625328106E43CEC7FD7CF71AEDA0A3101F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\514d7c625328106e43cec7fd7cf71aeda0a3101f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\514D7C625328106E43CEC7FD7CF71AEDA0A3101F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\514d7c625328106e43cec7fd7cf71aeda0a3101f", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\522FF036651FEA29F227BFB14BD934175DDBA62A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\522ff036651fea29f227bfb14bd934175ddba62a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\522FF036651FEA29F227BFB14BD934175DDBA62A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\522ff036651fea29f227bfb14bd934175ddba62a", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5289F8C4AB5388DE2FCD562674EDF6674FB6DD30..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5289f8c4ab5388de2fcd562674edf6674fb6dd30..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5289F8C4AB5388DE2FCD562674EDF6674FB6DD30", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5289f8c4ab5388de2fcd562674edf6674fb6dd30", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\529cd0d4c166c4989baaba7e5ff50f75fb1d22d3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\529cd0d4c166c4989baaba7e5ff50f75fb1d22d3", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\52ECE00B624C0C246123D20C46C3EE4F390A42FE..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\52ece00b624c0c246123d20c46c3ee4f390a42fe..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\52ECE00B624C0C246123D20C46C3EE4F390A42FE", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\52ece00b624c0c246123d20c46c3ee4f390a42fe", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\539C21F72CC831D883A265394E7125EFC208B096..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\539c21f72cc831d883a265394e7125efc208b096..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\539C21F72CC831D883A265394E7125EFC208B096", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\539c21f72cc831d883a265394e7125efc208b096", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\53dae4b1d7bff6744ccaf7207de631267f9883dc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\53dae4b1d7bff6744ccaf7207de631267f9883dc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\53E9CAA90A10C82CF9C2D5393B332D17B263105E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\53e9caa90a10c82cf9c2d5393b332d17b263105e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\53E9CAA90A10C82CF9C2D5393B332D17B263105E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\53e9caa90a10c82cf9c2d5393b332d17b263105e", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\54BF6D9D46D035228AC887ABC41B451F2BA38C02..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\54bf6d9d46d035228ac887abc41b451f2ba38c02..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\54BF6D9D46D035228AC887ABC41B451F2BA38C02", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\54bf6d9d46d035228ac887abc41b451f2ba38c02", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5588A68FFECF7B388E18C33727BF06B30B837DF1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5588a68ffecf7b388e18c33727bf06b30b837df1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5588A68FFECF7B388E18C33727BF06B30B837DF1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5588a68ffecf7b388e18c33727bf06b30b837df1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\559737B84286037BF56FE9E46C53581FB6FF6751..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\559737b84286037bf56fe9e46c53581fb6ff6751..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\559737B84286037BF56FE9E46C53581FB6FF6751", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\559737b84286037bf56fe9e46c53581fb6ff6751", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\56945BFE2B00EED1BE4F7B1F389030A0AF203742..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\56945bfe2b00eed1be4f7b1f389030a0af203742..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\56945BFE2B00EED1BE4F7B1F389030A0AF203742", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\56945bfe2b00eed1be4f7b1f389030a0af203742", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\56B48B214C8C7AC2CE81EFC4F92C4550FB675AE9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\56b48b214c8c7ac2ce81efc4f92c4550fb675ae9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\56B48B214C8C7AC2CE81EFC4F92C4550FB675AE9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\56b48b214c8c7ac2ce81efc4f92c4550fb675ae9", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\56C1D667A6AFD5406F830882D54923461E079C1B..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\56c1d667a6afd5406f830882d54923461e079c1b..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\56C1D667A6AFD5406F830882D54923461E079C1B", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\56c1d667a6afd5406f830882d54923461e079c1b", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5740B2DD533A74C3D20DD1D045CF7090D3BFB1AC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5740b2dd533a74c3d20dd1d045cf7090d3bfb1ac..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5740B2DD533A74C3D20DD1D045CF7090D3BFB1AC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5740b2dd533a74c3d20dd1d045cf7090d3bfb1ac", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\577655B6F15A0EEA0864C0703652DE24C091B634..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\577655b6f15a0eea0864c0703652de24c091b634..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\577655B6F15A0EEA0864C0703652DE24C091B634", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\577655b6f15a0eea0864c0703652de24c091b634", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5781F439935B6472D7D312E75A3B766C3E30CF60..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5781f439935b6472d7d312e75a3b766c3e30cf60..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5781F439935B6472D7D312E75A3B766C3E30CF60", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5781f439935b6472d7d312e75a3b766c3e30cf60", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\579EC9227C4A988DCC4894D82AA161957107515D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\579ec9227c4a988dcc4894d82aa161957107515d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\579EC9227C4A988DCC4894D82AA161957107515D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\579ec9227c4a988dcc4894d82aa161957107515d", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\57E662573FD9E42D3972BE92D3DF0557C7B2E836..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\57e662573fd9e42d3972be92d3df0557c7b2e836..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\57E662573FD9E42D3972BE92D3DF0557C7B2E836", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\57e662573fd9e42d3972be92d3df0557c7b2e836", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\57FB9388D9B054D289CC913E797B5C5217B6A217..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\57fb9388d9b054d289cc913e797b5c5217b6a217..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\57FB9388D9B054D289CC913E797B5C5217B6A217", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\57fb9388d9b054d289cc913e797b5c5217b6a217", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\58A845FD76589B14EF62BB6CFEA62DB0C7CCFBBE..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\58a845fd76589b14ef62bb6cfea62db0c7ccfbbe..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\58A845FD76589B14EF62BB6CFEA62DB0C7CCFBBE", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\58a845fd76589b14ef62bb6cfea62db0c7ccfbbe", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\58BFE77FA719F36CE48D4A317C753C845C38FE29..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\58bfe77fa719f36ce48d4a317c753c845c38fe29..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\58BFE77FA719F36CE48D4A317C753C845C38FE29", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\58bfe77fa719f36ce48d4a317c753c845c38fe29", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\59248032DB55D8A9E0296A51BC66F3DEA6028EA5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\59248032db55d8a9e0296a51bc66f3dea6028ea5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\59248032DB55D8A9E0296A51BC66F3DEA6028EA5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\59248032db55d8a9e0296a51bc66f3dea6028ea5", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\592BC6129BB410343931D35AFB0FE270C66E58F0..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\592bc6129bb410343931d35afb0fe270c66e58f0..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\592BC6129BB410343931D35AFB0FE270C66E58F0", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\592bc6129bb410343931d35afb0fe270c66e58f0", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\59BB52B352DE6D0ED5D0376B33855D43CA80B3F7..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\59bb52b352de6d0ed5d0376b33855d43ca80b3f7..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\59BB52B352DE6D0ED5D0376B33855D43CA80B3F7", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\59bb52b352de6d0ed5d0376b33855d43ca80b3f7", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\59D05F1B38666C8EF68BDEE20A28647F754464F6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\59d05f1b38666c8ef68bdee20a28647f754464f6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\59D05F1B38666C8EF68BDEE20A28647F754464F6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\59d05f1b38666c8ef68bdee20a28647f754464f6", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5a39fcb4ccae4a6c76307026d7c882b4ae85b1f9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5a39fcb4ccae4a6c76307026d7c882b4ae85b1f9", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5A6EEC1674DA4669A4FF612E7924A91FBF501426..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5a6eec1674da4669a4ff612e7924a91fbf501426..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5A6EEC1674DA4669A4FF612E7924A91FBF501426", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5a6eec1674da4669a4ff612e7924a91fbf501426", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5AF1F43361120818C2E543605F5DF938574B1EDC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5af1f43361120818c2e543605f5df938574b1edc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5AF1F43361120818C2E543605F5DF938574B1EDC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5af1f43361120818c2e543605f5df938574b1edc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5B1B55B57E2440A52DE3FED7E02C83E04A78B0FD..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5b1b55b57e2440a52de3fed7e02c83e04a78b0fd..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5B1B55B57E2440A52DE3FED7E02C83E04A78B0FD", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5b1b55b57e2440a52de3fed7e02c83e04a78b0fd", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5B928BD544BA66929A709C6AEC9D5968DCB905A1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5b928bd544ba66929a709c6aec9d5968dcb905a1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5B928BD544BA66929A709C6AEC9D5968DCB905A1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5b928bd544ba66929a709c6aec9d5968dcb905a1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5BDDE6C7804D11CE399AF314C3D33E47FBAE7C88..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5bdde6c7804d11ce399af314c3d33e47fbae7c88..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5BDDE6C7804D11CE399AF314C3D33E47FBAE7C88", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5bdde6c7804d11ce399af314c3d33e47fbae7c88", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5C30F12D68A505E4AE0A6A3D896A1EC9C549AE96..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5c30f12d68a505e4ae0a6a3d896a1ec9c549ae96..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5C30F12D68A505E4AE0A6A3D896A1EC9C549AE96", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5c30f12d68a505e4ae0a6a3d896a1ec9c549ae96", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5D3D330EFBD2B9CD6EB45919D9403F605414EFA5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5d3d330efbd2b9cd6eb45919d9403f605414efa5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5D3D330EFBD2B9CD6EB45919D9403F605414EFA5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5d3d330efbd2b9cd6eb45919d9403f605414efa5", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5D44AC703C53CC7EE6356F698FD1B03DA81FFE47..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5d44ac703c53cc7ee6356f698fd1b03da81ffe47..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5D44AC703C53CC7EE6356F698FD1B03DA81FFE47", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5d44ac703c53cc7ee6356f698fd1b03da81ffe47", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5D4D29BF9DDC265D3BF3C2EC2AD949959DB051E0..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5d4d29bf9ddc265d3bf3c2ec2ad949959db051e0..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5D4D29BF9DDC265D3BF3C2EC2AD949959DB051E0", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5d4d29bf9ddc265d3bf3c2ec2ad949959db051e0", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5D9BD74008929159A2B20BA288E8C14E90139D9E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5d9bd74008929159a2b20ba288e8c14e90139d9e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5D9BD74008929159A2B20BA288E8C14E90139D9E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5d9bd74008929159a2b20ba288e8c14e90139d9e", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5E4954707B44E5A4B4ACF5F22B52219A1DCA477F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5e4954707b44e5a4b4acf5f22b52219a1dca477f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5E4954707B44E5A4B4ACF5F22B52219A1DCA477F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5e4954707b44e5a4b4acf5f22b52219a1dca477f", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5E6743008EAD7F878BBA3DB3AC74B0F7B6847E62..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5e6743008ead7f878bba3db3ac74b0f7b6847e62..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5E6743008EAD7F878BBA3DB3AC74B0F7B6847E62", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5e6743008ead7f878bba3db3ac74b0f7b6847e62", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5E8FB85F742729ABDB8D2A0429759BA5D6E156B0..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5e8fb85f742729abdb8d2a0429759ba5d6e156b0..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5E8FB85F742729ABDB8D2A0429759BA5D6E156B0", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5e8fb85f742729abdb8d2a0429759ba5d6e156b0", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5E97E077892FC573B11B9DE18E4E04712EE38B25..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5e97e077892fc573b11b9de18e4e04712ee38b25..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5E97E077892FC573B11B9DE18E4E04712EE38B25", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5e97e077892fc573b11b9de18e4e04712ee38b25", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5EDCA8EAB63E705143E36A7639D1A2CE2F619754..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5edca8eab63e705143e36a7639d1a2ce2f619754..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5EDCA8EAB63E705143E36A7639D1A2CE2F619754", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5edca8eab63e705143e36a7639d1a2ce2f619754", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5EE31D123C1A55F6FF9368B871E37AC7D9F01FE5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5ee31d123c1a55f6ff9368b871e37ac7d9f01fe5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5EE31D123C1A55F6FF9368B871E37AC7D9F01FE5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5ee31d123c1a55f6ff9368b871e37ac7d9f01fe5", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5F13BE737EB5A225243B9A7C6D508D72DBD5C0B5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5f13be737eb5a225243b9a7c6d508d72dbd5c0b5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5F13BE737EB5A225243B9A7C6D508D72DBD5C0B5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5f13be737eb5a225243b9a7c6d508d72dbd5c0b5", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5FC12D3D59A53A815787F247F7BC644A4F2DBC17..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5fc12d3d59a53a815787f247f7bc644a4f2dbc17..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\5FC12D3D59A53A815787F247F7BC644A4F2DBC17", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\5fc12d3d59a53a815787f247f7bc644a4f2dbc17", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\602AF084D952E6E4F98EFA78BC6FE6B89DEE91B8..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\602af084d952e6e4f98efa78bc6fe6b89dee91b8..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\602AF084D952E6E4F98EFA78BC6FE6B89DEE91B8", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\602af084d952e6e4f98efa78bc6fe6b89dee91b8", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\60A4AF5C5655CA195B9AF21AADCF84E905FEBC55..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\60a4af5c5655ca195b9af21aadcf84e905febc55..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\60A4AF5C5655CA195B9AF21AADCF84E905FEBC55", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\60a4af5c5655ca195b9af21aadcf84e905febc55", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6110E52DCC41B003F9ABB87AF539D456402B7F80..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6110e52dcc41b003f9abb87af539d456402b7f80..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6110E52DCC41B003F9ABB87AF539D456402B7F80", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6110e52dcc41b003f9abb87af539d456402b7f80", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6411FA6F2F74D405C46A9BD6767C418000B64A24..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6411fa6f2f74d405c46a9bd6767c418000b64a24..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6411FA6F2F74D405C46A9BD6767C418000B64A24", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6411fa6f2f74d405c46a9bd6767c418000b64a24", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6422ADCCC2AA6961DE5FFC515106F8B2D0D2D3E7..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6422adccc2aa6961de5ffc515106f8b2d0d2d3e7..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6422ADCCC2AA6961DE5FFC515106F8B2D0D2D3E7", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6422adccc2aa6961de5ffc515106f8b2d0d2d3e7", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\650A3159BCA4987DD5B1950095087AFC89EDFBF4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\650a3159bca4987dd5b1950095087afc89edfbf4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\650A3159BCA4987DD5B1950095087AFC89EDFBF4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\650a3159bca4987dd5b1950095087afc89edfbf4", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\656916B9B7899D4B69D34E1DD3BBD389F436F8F5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\656916b9b7899d4b69d34e1dd3bbd389f436f8f5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\656916B9B7899D4B69D34E1DD3BBD389F436F8F5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\656916b9b7899d4b69d34e1dd3bbd389f436f8f5", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6628E2AAC6FF3B0BE44D2610110ACAF9071F1C8D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6628e2aac6ff3b0be44d2610110acaf9071f1c8d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6628E2AAC6FF3B0BE44D2610110ACAF9071F1C8D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6628e2aac6ff3b0be44d2610110acaf9071f1c8d", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\66913F89F6E2C2FADE791B6B6280E27520671B4C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\66913f89f6e2c2fade791b6b6280e27520671b4c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\66913F89F6E2C2FADE791B6B6280E27520671B4C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\66913f89f6e2c2fade791b6b6280e27520671b4c", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\66B64249060DCBD0E7A35E24F8305D7FC258E22F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\66b64249060dcbd0e7a35e24f8305d7fc258e22f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\66B64249060DCBD0E7A35E24F8305D7FC258E22F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\66b64249060dcbd0e7a35e24f8305d7fc258e22f", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\66EA61D5036D6A8A2DDD0634666EF265BF3C33C3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\66ea61d5036d6a8a2ddd0634666ef265bf3c33c3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\66EA61D5036D6A8A2DDD0634666EF265BF3C33C3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\66ea61d5036d6a8a2ddd0634666ef265bf3c33c3", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6730E7D38947125CF79CAEB391A7C2548F883DD9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6730e7d38947125cf79caeb391a7c2548f883dd9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6730E7D38947125CF79CAEB391A7C2548F883DD9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6730e7d38947125cf79caeb391a7c2548f883dd9", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\676FBE82E89585DA0DA55A36C5FE66D6C832FAC6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\676fbe82e89585da0da55a36c5fe66d6c832fac6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\676FBE82E89585DA0DA55A36C5FE66D6C832FAC6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\676fbe82e89585da0da55a36c5fe66d6c832fac6", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\681E7166DB1F0B0A148FE6D0903D513EDE8F745D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\681e7166db1f0b0a148fe6d0903d513ede8f745d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\681E7166DB1F0B0A148FE6D0903D513EDE8F745D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\681e7166db1f0b0a148fe6d0903d513ede8f745d", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\68426AE4792A86816CF3B07D8D4754C947EA08B5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\68426ae4792a86816cf3b07d8d4754c947ea08b5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\68426AE4792A86816CF3B07D8D4754C947EA08B5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\68426ae4792a86816cf3b07d8d4754c947ea08b5", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\685EFCCD3945B7E4D6ED3A85EE423A4A95942846..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\685efccd3945b7e4d6ed3a85ee423a4a95942846..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\685EFCCD3945B7E4D6ED3A85EE423A4A95942846", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\685efccd3945b7e4d6ed3a85ee423a4a95942846", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\687958F5E9A2BEEA04A3614DD23FC37871418806..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\687958f5e9a2beea04a3614dd23fc37871418806..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\687958F5E9A2BEEA04A3614DD23FC37871418806", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\687958f5e9a2beea04a3614dd23fc37871418806", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\68F3916AD8F0D06279A8B2B1822559F18A0015C1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\68f3916ad8f0d06279a8b2b1822559f18a0015c1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\68F3916AD8F0D06279A8B2B1822559F18A0015C1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\68f3916ad8f0d06279a8b2b1822559f18a0015c1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\698AC159A6BCBA0D13FE6F10F1A38E498F826F33..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\698ac159a6bcba0d13fe6f10f1a38e498f826f33..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\698AC159A6BCBA0D13FE6F10F1A38E498F826F33", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\698ac159a6bcba0d13fe6f10f1a38e498f826f33", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6B59D88F10856ABB980993D7332F49AB71BD33B8..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6b59d88f10856abb980993d7332f49ab71bd33b8..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6B59D88F10856ABB980993D7332F49AB71BD33B8", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6b59d88f10856abb980993d7332f49ab71bd33b8", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6BFE0EB337F328928E30DD51C1084B7FD4937D99..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6bfe0eb337f328928e30dd51c1084b7fd4937d99..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6BFE0EB337F328928E30DD51C1084B7FD4937D99", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6bfe0eb337f328928e30dd51c1084b7fd4937d99", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6D2728C8959E4B632BDBA3B15F34FC9075936CA6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6d2728c8959e4b632bdba3b15f34fc9075936ca6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6D2728C8959E4B632BDBA3B15F34FC9075936CA6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6d2728c8959e4b632bdba3b15f34fc9075936ca6", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6E737977754F860FE206E1BDA7E561C5EFCF040B..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6e737977754f860fe206e1bda7e561c5efcf040b..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6E737977754F860FE206E1BDA7E561C5EFCF040B", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6e737977754f860fe206e1bda7e561c5efcf040b", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6ECDE68737A8AB107AD15BF26496698293735A7F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6ecde68737a8ab107ad15bf26496698293735a7f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6ECDE68737A8AB107AD15BF26496698293735A7F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6ecde68737a8ab107ad15bf26496698293735a7f", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6EEFC19174D5EB9F9D4298CAA1169279C37B51A6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6eefc19174d5eb9f9d4298caa1169279c37b51a6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6EEFC19174D5EB9F9D4298CAA1169279C37B51A6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6eefc19174d5eb9f9d4298caa1169279c37b51a6", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F0D7B7CC1D4D00C50AEDBC1B3D0FBAD11BE073F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f0d7b7cc1d4d00c50aedbc1b3d0fbad11be073f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F0D7B7CC1D4D00C50AEDBC1B3D0FBAD11BE073F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f0d7b7cc1d4d00c50aedbc1b3d0fbad11be073f", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F1FC0B439CD82ECE281A60F7927EB116F5E5108..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f1fc0b439cd82ece281a60f7927eb116f5e5108..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F1FC0B439CD82ECE281A60F7927EB116F5E5108", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f1fc0b439cd82ece281a60f7927eb116f5e5108", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F26192E14C4C0B13B7860D0A345A5733C7C06EE..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f26192e14c4c0b13b7860d0a345a5733c7c06ee..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F26192E14C4C0B13B7860D0A345A5733C7C06EE", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f26192e14c4c0b13b7860d0a345a5733c7c06ee", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F392E73ACA1B277C637CBB45733E07EAD74CBCE..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f392e73aca1b277c637cbb45733e07ead74cbce..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F392E73ACA1B277C637CBB45733E07EAD74CBCE", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f392e73aca1b277c637cbb45733e07ead74cbce", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F39E22506AE2A3DADD87EF5D9EF306B0235583A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f39e22506ae2a3dadd87ef5d9ef306b0235583a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F39E22506AE2A3DADD87EF5D9EF306B0235583A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f39e22506ae2a3dadd87ef5d9ef306b0235583a", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F4E0DE1D5CE86753B3CD75D8F8EFFC8458578F5..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f4e0de1d5ce86753b3cd75d8f8effc8458578f5..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F4E0DE1D5CE86753B3CD75D8F8EFFC8458578F5", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f4e0de1d5ce86753b3cd75d8f8effc8458578f5", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F4FA43590A63EB51F16A747B6869FEA664D492D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f4fa43590a63eb51f16a747b6869fea664d492d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F4FA43590A63EB51F16A747B6869FEA664D492D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f4fa43590a63eb51f16a747b6869fea664d492d", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F8FB4D82C35910ECF7AB512D58576D942963BA4..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f8fb4d82c35910ecf7ab512d58576d942963ba4..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6F8FB4D82C35910ECF7AB512D58576D942963BA4", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6f8fb4d82c35910ecf7ab512d58576d942963ba4", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6FAB625AF8A09EB1F9AD0CA5C0405BDB6AFC978E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6fab625af8a09eb1f9ad0ca5c0405bdb6afc978e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\6FAB625AF8A09EB1F9AD0CA5C0405BDB6AFC978E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\6fab625af8a09eb1f9ad0ca5c0405bdb6afc978e", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\70878CE2EAADC1E41BAE291FD13B352563DF6022..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\70878ce2eaadc1e41bae291fd13b352563df6022..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\70878CE2EAADC1E41BAE291FD13B352563DF6022", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\70878ce2eaadc1e41bae291fd13b352563df6022", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\70AE3BE112FC73F5E433F373EC3916C36CE729FC..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\70ae3be112fc73f5e433f373ec3916c36ce729fc..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\70AE3BE112FC73F5E433F373EC3916C36CE729FC", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\70ae3be112fc73f5e433f373ec3916c36ce729fc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\70B3E6FD6779EEBF5E87EAFEA269ECDBD889A0BB..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\70b3e6fd6779eebf5e87eafea269ecdbd889a0bb..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\70B3E6FD6779EEBF5E87EAFEA269ECDBD889A0BB", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\70b3e6fd6779eebf5e87eafea269ecdbd889a0bb", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\70ED86B2851AF1F558CF9E13C146068B2300BD5F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\70ed86b2851af1f558cf9e13c146068b2300bd5f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\70ED86B2851AF1F558CF9E13C146068B2300BD5F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\70ed86b2851af1f558cf9e13c146068b2300bd5f", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\714AB8F4DF28029AFC0681556F48D37351016356..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\714ab8f4df28029afc0681556f48d37351016356..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\714AB8F4DF28029AFC0681556F48D37351016356", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\714ab8f4df28029afc0681556f48d37351016356", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\71AEDCA900A67FA2FAB608A99A2E36584BD343FB..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\71aedca900a67fa2fab608a99a2e36584bd343fb..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\71AEDCA900A67FA2FAB608A99A2E36584BD343FB", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\71aedca900a67fa2fab608a99a2e36584bd343fb", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\72383665FB6B3DB66261C12404F5ABD0E4B1FADE..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\72383665fb6b3db66261c12404f5abd0e4b1fade..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\72383665FB6B3DB66261C12404F5ABD0E4B1FADE", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\72383665fb6b3db66261c12404f5abd0e4b1fade", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\72B792700CA27D878D3F3BF0C712462EBAC296E1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\72b792700ca27d878d3f3bf0c712462ebac296e1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\72B792700CA27D878D3F3BF0C712462EBAC296E1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\72b792700ca27d878d3f3bf0c712462ebac296e1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7394B7FE1C950657969E92E15FDA4293AF92F94E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7394b7fe1c950657969e92e15fda4293af92f94e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7394B7FE1C950657969E92E15FDA4293AF92F94E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7394b7fe1c950657969e92e15fda4293af92f94e", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\73A976E5255CDAB8B19ACBFC7EBBB3682467E56A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\73a976e5255cdab8b19acbfc7ebbb3682467e56a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\73A976E5255CDAB8B19ACBFC7EBBB3682467E56A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\73a976e5255cdab8b19acbfc7ebbb3682467e56a", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\745F42A62F3552DEBB8A0452590DC0EDCB0B05F3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\745f42a62f3552debb8a0452590dc0edcb0b05f3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\745F42A62F3552DEBB8A0452590DC0EDCB0B05F3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\745f42a62f3552debb8a0452590dc0edcb0b05f3", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\756A937558919DF71FCB88D7B4DA15352D72DC2F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\756a937558919df71fcb88d7b4da15352d72dc2f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\756A937558919DF71FCB88D7B4DA15352D72DC2F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\756a937558919df71fcb88d7b4da15352d72dc2f", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7604B9DE587D6F4084BF95B41C1F4B2EC876892C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7604b9de587d6f4084bf95b41c1f4b2ec876892c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7604B9DE587D6F4084BF95B41C1F4B2EC876892C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7604b9de587d6f4084bf95b41c1f4b2ec876892c", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\767A9961FDB5AC27D3D7CE17D91203113C888EE1..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\767a9961fdb5ac27d3d7ce17d91203113c888ee1..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\767A9961FDB5AC27D3D7CE17D91203113C888EE1", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\767a9961fdb5ac27d3d7ce17d91203113c888ee1", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\768C8D1AE760F166BFD97A67C4A578795D3D56FF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\768c8d1ae760f166bfd97a67c4a578795d3d56ff..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\768C8D1AE760F166BFD97A67C4A578795D3D56FF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\768c8d1ae760f166bfd97a67c4a578795d3d56ff", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\76AAE75069D3F560B973FB3C30F2BDBFA042BFFF..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\76aae75069d3f560b973fb3c30f2bdbfa042bfff..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\76AAE75069D3F560B973FB3C30F2BDBFA042BFFF", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\76aae75069d3f560b973fb3c30f2bdbfa042bfff", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\76EF1292F45B28008B0E37EDAF898359BDA69EF7..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\76ef1292f45b28008b0e37edaf898359bda69ef7..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\76EF1292F45B28008B0E37EDAF898359BDA69EF7", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\76ef1292f45b28008b0e37edaf898359bda69ef7", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\76FFAADFD6E911E3E7F09E99D9A7FEB643A7794E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\76ffaadfd6e911e3e7f09e99d9a7feb643a7794e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\76FFAADFD6E911E3E7F09E99D9A7FEB643A7794E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\76ffaadfd6e911e3e7f09e99d9a7feb643a7794e", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7745B0AA62A2D610E6DF708BD9E5017145E8592E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7745b0aa62a2d610e6df708bd9e5017145e8592e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7745B0AA62A2D610E6DF708BD9E5017145E8592E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7745b0aa62a2d610e6df708bd9e5017145e8592e", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\77CEF3A6676F7D9193ED09C07246A8DEC5D24FE9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\77cef3a6676f7d9193ed09c07246a8dec5d24fe9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\77CEF3A6676F7D9193ED09C07246A8DEC5D24FE9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\77cef3a6676f7d9193ed09c07246a8dec5d24fe9", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7807899BF5E94564AFE48A5B5DF11C0FDB47F065..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7807899bf5e94564afe48a5b5df11c0fdb47f065..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7807899BF5E94564AFE48A5B5DF11C0FDB47F065", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7807899bf5e94564afe48a5b5df11c0fdb47f065", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\781E33189FE64505AE85DAFD54ED7730A4A55952..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\781e33189fe64505ae85dafd54ed7730a4a55952..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\781E33189FE64505AE85DAFD54ED7730A4A55952", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\781e33189fe64505ae85dafd54ed7730a4a55952", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\785445A5FF1777FD0EA02B65B10108B52E873145..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\785445a5ff1777fd0ea02b65b10108b52e873145..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\785445A5FF1777FD0EA02B65B10108B52E873145", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\785445a5ff1777fd0ea02b65b10108b52e873145", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\788D679B0EF749BCC9E1D90D68CF10F4EAC25366..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\788d679b0ef749bcc9e1d90d68cf10f4eac25366..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\788D679B0EF749BCC9E1D90D68CF10F4EAC25366", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\788d679b0ef749bcc9e1d90d68cf10f4eac25366", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\78A520FE200DD59F7079043C2E4494D582DB5E27..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\78a520fe200dd59f7079043c2e4494d582db5e27..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\78A520FE200DD59F7079043C2E4494D582DB5E27", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\78a520fe200dd59f7079043c2e4494d582db5e27", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\79122AC35356132F14E7AA3248B675B5BA972274..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\79122ac35356132f14e7aa3248b675b5ba972274..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\79122AC35356132F14E7AA3248B675B5BA972274", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\79122ac35356132f14e7aa3248b675b5ba972274", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\793B27BA59D8A7B2BA6678FEAB19C5DA43E97721..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\793b27ba59d8a7b2ba6678feab19c5da43e97721..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\793B27BA59D8A7B2BA6678FEAB19C5DA43E97721", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\793b27ba59d8a7b2ba6678feab19c5da43e97721", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\79495235F3219B3019A451820D1C43C06BFD4393..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\79495235f3219b3019a451820d1c43c06bfd4393..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\79495235F3219B3019A451820D1C43C06BFD4393", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\79495235f3219b3019a451820d1c43c06bfd4393", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\79F42694978874799A67708237EECF993F994146..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\79f42694978874799a67708237eecf993f994146..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\79F42694978874799A67708237EECF993F994146", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\79f42694978874799a67708237eecf993f994146", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7A1A1466465E81B4F3F17B7B1E323BC295511E34..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7a1a1466465e81b4f3f17b7b1e323bc295511e34..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7A1A1466465E81B4F3F17B7B1E323BC295511E34", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7a1a1466465e81b4f3f17b7b1e323bc295511e34", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7A315F0F46ED849CE7A91455D41326BE0FBD8DF6..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7a315f0f46ed849ce7a91455d41326be0fbd8df6..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7A315F0F46ED849CE7A91455D41326BE0FBD8DF6", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7a315f0f46ed849ce7a91455d41326be0fbd8df6", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7A7B3AEA0BD15BF742C8652DAB7DD9291E6B44E3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7a7b3aea0bd15bf742c8652dab7dd9291e6b44e3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7A7B3AEA0BD15BF742C8652DAB7DD9291E6B44E3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7a7b3aea0bd15bf742c8652dab7dd9291e6b44e3", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7A8D3A9360CC37F0AD80962D4AEA72B6D0F0B2B3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7a8d3a9360cc37f0ad80962d4aea72b6d0f0b2b3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7A8D3A9360CC37F0AD80962D4AEA72B6D0F0B2B3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7a8d3a9360cc37f0ad80962d4aea72b6d0f0b2b3", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7A93EF828A8C217F3A12A7AF2896C1EA3EA58080..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7a93ef828a8c217f3a12a7af2896c1ea3ea58080..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7A93EF828A8C217F3A12A7AF2896C1EA3EA58080", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7a93ef828a8c217f3a12a7af2896c1ea3ea58080", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7B2118CB15DE60985B2F5A4B0A54FF4D177BD7F2..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7b2118cb15de60985b2f5a4b0a54ff4d177bd7f2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7B2118CB15DE60985B2F5A4B0A54FF4D177BD7F2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7b2118cb15de60985b2f5a4b0a54ff4d177bd7f2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7BA99981D9CFABDE0D8A629A068D5C4B067AFF15..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7ba99981d9cfabde0d8a629a068d5c4b067aff15..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7BA99981D9CFABDE0D8A629A068D5C4B067AFF15", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7ba99981d9cfabde0d8a629a068d5c4b067aff15", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7BC5C2025F544E50B3DE3549ADA4AA613D5C7842..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7bc5c2025f544e50b3de3549ada4aa613d5c7842..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7BC5C2025F544E50B3DE3549ADA4AA613D5C7842", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7bc5c2025f544e50b3de3549ada4aa613d5c7842", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7C0135458BD7055C44A6FC5595953EC97AE2564C..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7c0135458bd7055c44a6fc5595953ec97ae2564c..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7C0135458BD7055C44A6FC5595953EC97AE2564C", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7c0135458bd7055c44a6fc5595953ec97ae2564c", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7D085640CA3ACCA510CD84959D65912BDC5E033D..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7d085640ca3acca510cd84959d65912bdc5e033d..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7D085640CA3ACCA510CD84959D65912BDC5E033D", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7d085640ca3acca510cd84959d65912bdc5e033d", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7D92B4388F8E6B32F40E02B9DD20CA3D76209F4A..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7d92b4388f8e6b32f40e02b9dd20ca3d76209f4a..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7D92B4388F8E6B32F40E02B9DD20CA3D76209F4A", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7d92b4388f8e6b32f40e02b9dd20ca3d76209f4a", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7DC89B7400C4C6B5AC1000C69DB6591A4EA8244E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7dc89b7400c4c6b5ac1000c69db6591a4ea8244e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7DC89B7400C4C6B5AC1000C69DB6591A4EA8244E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7dc89b7400c4c6b5ac1000c69db6591a4ea8244e", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7E6A4DDD6EBE916C46924CED08FC10C7E58A9A59..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7e6a4ddd6ebe916c46924ced08fc10c7e58a9a59..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7E6A4DDD6EBE916C46924CED08FC10C7E58A9A59", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7e6a4ddd6ebe916c46924ced08fc10c7e58a9a59", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7EB87F80F5E3271B910DF76ECB8FC273CFC9B047..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7eb87f80f5e3271b910df76ecb8fc273cfc9b047..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7EB87F80F5E3271B910DF76ECB8FC273CFC9B047", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7eb87f80f5e3271b910df76ecb8fc273cfc9b047", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7ED75B3614C7D3EEE86D39A5F382CBE557DA312E..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7ed75b3614c7d3eee86d39a5f382cbe557da312e..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7ED75B3614C7D3EEE86D39A5F382CBE557DA312E", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7ed75b3614c7d3eee86d39a5f382cbe557da312e", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7EECEC96C96F7EFD42BCCEF138EB2246983AEE2B..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7eecec96c96f7efd42bccef138eb2246983aee2b..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7EECEC96C96F7EFD42BCCEF138EB2246983AEE2B", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7eecec96c96f7efd42bccef138eb2246983aee2b", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7FE50BE7077DE90D076E000C0A24643AF8CD9AC9..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7fe50be7077de90d076e000c0a24643af8cd9ac9..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\7FE50BE7077DE90D076E000C0A24643AF8CD9AC9", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\7fe50be7077de90d076e000c0a24643af8cd9ac9", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\804D00971A6713DF10CAB1B024CA03F9B3C038F2..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\804d00971a6713df10cab1b024ca03f9b3c038f2..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\804D00971A6713DF10CAB1B024CA03F9B3C038F2", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\804d00971a6713df10cab1b024ca03f9b3c038f2", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\80F2F68FB2BDAC2A31FFF46701389C7EA9C7B74F..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\80f2f68fb2bdac2a31fff46701389c7ea9c7b74f..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\80F2F68FB2BDAC2A31FFF46701389C7EA9C7B74F", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\80f2f68fb2bdac2a31fff46701389c7ea9c7b74f", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\816B0061E79B6E53649EC38D2C76C3CB97737646..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\816b0061e79b6e53649ec38d2c76c3cb97737646..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\816B0061E79B6E53649EC38D2C76C3CB97737646", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\816b0061e79b6e53649ec38d2c76c3cb97737646", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\8181A6D542BC353BBF64D59BC6D1E6B99FE41D04..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\8181a6d542bc353bbf64d59bc6d1e6b99fe41d04..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\8181A6D542BC353BBF64D59BC6D1E6B99FE41D04", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\8181a6d542bc353bbf64d59bc6d1e6b99fe41d04", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\81BAD44F278646A44E19B8E1BB5D91720320EAF3..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\81bad44f278646a44e19b8e1bb5d91720320eaf3..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\81BAD44F278646A44E19B8E1BB5D91720320EAF3", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\81bad44f278646a44e19b8e1bb5d91720320eaf3", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\83A45FEF980B64BF75E4A05F00358D435194C556..doc", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\83a45fef980b64bf75e4a05f00358d435194c556..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\83A45FEF980B64BF75E4A05F00358D435194C556", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\entries\\83a45fef980b64bf75e4a05f00358d435194c556", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "STD_ERROR_HANDLE", "hashes": [], "norm_filename": "std_error_handle", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\documents", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "Default.rdp", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\default.rdp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\tmpAD23.tmp.bat", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\tmpad23.tmp.bat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "nul", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nul", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [ { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Script Host\\Settings", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows Script Host\\Settings", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\.VBS", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\VBSFile\\ScriptEngine", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read", "write" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read", "write" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers", "type": "registry_artifact", "version": 1 } ], "type": "artifacts", "urls": [ { "operations": "GeT", "type": "url_artifact", "url": "http://rorymartin8.info/hudgy356?", "version": 1 } ], "version": 1 }, "extracted_files": [ { "archive_path": "extracted_files/60d60dff0d3af3b564e43bc87ef5a63ff6146da7", "file_type": "created_file", "id": "file_2", "md5_hash": "5da21af74810e3655bcbbe40660f21b8", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe", "sha1_hash": "60d60dff0d3af3b564e43bc87ef5a63ff6146da7", "sha256_hash": "c0ce6c2f03e3174d347eb2136a230883a725fcd5179221f61435ea709a2ba81f", "size": 159535, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/60d60dff0d3af3b564e43bc87ef5a63ff6146da7", "file_type": "created_file", "id": "file_9", "md5_hash": "5da21af74810e3655bcbbe40660f21b8", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vworbzlbc.exe", "sha1_hash": "60d60dff0d3af3b564e43bc87ef5a63ff6146da7", "sha256_hash": "c0ce6c2f03e3174d347eb2136a230883a725fcd5179221f61435ea709a2ba81f", "size": 159535, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_3", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsga12c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_4", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsga12d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_5", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsma14e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_8", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vworbzlbc.exe", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fe582246792774c2c9dd15639ffa0aca90d6fd0b", "file_type": "created_file", "id": "file_6", "md5_hash": "3f176d1ee13b0d7d6bd92e1c7a0b9bae", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsma14e.tmp\\system.dll", "sha1_hash": "fe582246792774c2c9dd15639ffa0aca90d6fd0b", "sha256_hash": "fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e", "size": 11264, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4cc8b9e59434eae65374a5b790ec98fbab713871", "file_type": "created_file", "id": "file_7", "md5_hash": "5a028c895aaed43a1f4f16e880f83ad1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\w8nb", "sha1_hash": "4cc8b9e59434eae65374a5b790ec98fbab713871", "sha256_hash": "abed74c65d9b1562c2c9a10f35965d62f251742762cf28ca5dbd7813a9428db4", "size": 71559, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/93d35f2df9917e7aaf340810564816c2c688c316", "file_type": "created_file", "id": "file_10", "md5_hash": "cc3e8d276fce51e4f88c1006b5dc008b", "norm_filename": "c:\\users\\public\\ae09c984df6e74640b3271eadb5dd7c65fde806235b2cda478e0efa9129c09e7", "sha1_hash": "93d35f2df9917e7aaf340810564816c2c688c316", "sha256_hash": "a587adac0b3b0b4f0c3b840452be39769112f8b013ca28c494241c78ba627fc3", "size": 1026, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7cda05877b6effc0ea603a0925322fde261c51bf", "file_type": "created_file", "id": "file_12", "md5_hash": "dd4c03d383fa84a8ccba73e0b34a26ca", "norm_filename": "c:\\bootnxt..doc", "sha1_hash": "7cda05877b6effc0ea603a0925322fde261c51bf", "sha256_hash": "2f1a8b66d168474c99923af0795a35c2cfe9386f64b8000fa24c6fa3402f8a90", "size": 960, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_13", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_18", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_21", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\public\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_24", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\public\\videos\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_27", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\public\\pictures\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_30", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\public\\music\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_33", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\public\\libraries\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_38", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\public\\downloads\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_41", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\public\\documents\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_44", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\public\\desktop\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_53", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\public\\accountpictures\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_56", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\default\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_69", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_72", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_85", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_90", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_105", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\wyrssbqc98w\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_110", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_117", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_128", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_135", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\nxloupbusenpl3p-\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_138", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_147", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_154", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_161", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_168", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\saved games\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_171", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_188", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_191", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_202", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_213", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_216", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_235", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_242", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_255", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\6ghfbg6r\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_258", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\onedrive\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_261", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_270", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_281", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_296", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_305", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_312", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\tfeyyxaopweg\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_317", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_330", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_343", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_352", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_357", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\links\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_360", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_366", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_411", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_420", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_433", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_446", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_463", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\wcamw\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_468", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_471", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_476", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_480", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_483", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d4455bede93c9f5fc49fe0790534e41585f47c7e", "file_type": "created_file", "id": "file_492", "md5_hash": "1298ca6e188d639b1f38c31677bfcd95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\read___me.html", "sha1_hash": "d4455bede93c9f5fc49fe0790534e41585f47c7e", "sha256_hash": "87031c0a223a7a6a7228926375922fbbe858883727395619dd8376afc91b9774", "size": 4282, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e19f9661239c4fc761385ea3f39b00c9c2c35cba", "file_type": "created_file", "id": "file_15", "md5_hash": "351a1e2354f9c0ccd36e00b75bb50a18", "norm_filename": "c:\\bootsect.bak..doc", "sha1_hash": "e19f9661239c4fc761385ea3f39b00c9c2c35cba", "sha256_hash": "6f8e024373a23c013124ae16c0e7b38f583e44a252860f4c8380de99a38a9904", "size": 9136, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8b6bf3c2e93724a603abc372e772fd4c8a1a154b", "file_type": "created_file", "id": "file_17", "md5_hash": "03fa1e0ea94f96e88df614abbe0703b1", "norm_filename": "c:\\users\\desktop.ini..doc", "sha1_hash": "8b6bf3c2e93724a603abc372e772fd4c8a1a154b", "sha256_hash": "237e277cf6439d70c327f263cb443e4b9f23e1736ec5e38d7e9c5a7490626473", "size": 1120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/12b9d3fd9c7b25af9f6030245a9bc7b9a306cc6c", "file_type": "created_file", "id": "file_20", "md5_hash": "4557a99c5f04dd51e1c57f88eecabfd0", "norm_filename": "c:\\users\\public\\desktop.ini..doc", "sha1_hash": "12b9d3fd9c7b25af9f6030245a9bc7b9a306cc6c", "sha256_hash": "87d3ef818691192276efef80fb2d80a1c3f14d4313fe59566429b9a45a62aa82", "size": 1120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/80e00a9c04a8cb36846da3917dcd095811cd586f", "file_type": "created_file", "id": "file_23", "md5_hash": "912937c3c9a69c32211d4162d9199fbc", "norm_filename": "c:\\users\\public\\videos\\desktop.ini..doc", "sha1_hash": "80e00a9c04a8cb36846da3917dcd095811cd586f", "sha256_hash": "d2f030314ae9d645cb32763ac0b66125eb38d718a64fddc090376eeb540e07a9", "size": 1328, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a98610896d90d8323dc68135e79b714f585619b3", "file_type": "created_file", "id": "file_26", "md5_hash": "84033410a1053c63dedc29d312a02fff", "norm_filename": "c:\\users\\public\\pictures\\desktop.ini..doc", "sha1_hash": "a98610896d90d8323dc68135e79b714f585619b3", "sha256_hash": "120db3e5232d5ac034a29d84bbc28e14b7fd08333b515574643d086152052dbd", "size": 1328, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3bc9092919086b28b62ee2e0ce7096b7e43a9934", "file_type": "created_file", "id": "file_29", "md5_hash": "19df54bac0c5e64d04110ed7d79e8a14", "norm_filename": "c:\\users\\public\\music\\desktop.ini..doc", "sha1_hash": "3bc9092919086b28b62ee2e0ce7096b7e43a9934", "sha256_hash": "e7b4f0156e9e228454ba99d32e680487e680c7c7996cf48709ab54a2f42feb38", "size": 1328, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/aa46c370e3f5d5119f63168eef8c897f1947eece", "file_type": "created_file", "id": "file_32", "md5_hash": "14f972c6f596015135491f8d195c6999", "norm_filename": "c:\\users\\public\\libraries\\desktop.ini..doc", "sha1_hash": "aa46c370e3f5d5119f63168eef8c897f1947eece", "sha256_hash": "7d0f57e87e3fe8795d13be2e4f2cf9d4a2c15afab4aa58929dbd517077ae520e", "size": 1120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e846d09023adbf67887ee86e8a01b32f826d94ac", "file_type": "created_file", "id": "file_35", "md5_hash": "e36f7f7f6dc87e0af8a6b625daa9899a", "norm_filename": "c:\\users\\public\\libraries\\recordedtv.library-ms..doc", "sha1_hash": "e846d09023adbf67887ee86e8a01b32f826d94ac", "sha256_hash": "48ae42aa9a9bd8731f6d7b5cac820121c4adacb024ba9e772d6738b0928b61d8", "size": 1952, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2154f40bf4c4189c8d3e963b05c853e4f2df3b12", "file_type": "created_file", "id": "file_37", "md5_hash": "334326f2445576654b881ca75881a12a", "norm_filename": "c:\\users\\public\\downloads\\desktop.ini..doc", "sha1_hash": "2154f40bf4c4189c8d3e963b05c853e4f2df3b12", "sha256_hash": "70b9f46cd1678b6200e585463d78b91d07ae8ca9f254590fe1d5ce152f6f770a", "size": 1120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6781d39960831bab710c05f590166323646eb7da", "file_type": "created_file", "id": "file_40", "md5_hash": "fb9580698701e27432647edd2d7eaac7", "norm_filename": "c:\\users\\public\\documents\\desktop.ini..doc", "sha1_hash": "6781d39960831bab710c05f590166323646eb7da", "sha256_hash": "acce99a2039dd0fe6a4256f06e4ef93d4585828d8394bbb4aa8a4eca014888bc", "size": 1232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d36545d6fd09f7c2b574b68e120250347715a28d", "file_type": "created_file", "id": "file_43", "md5_hash": "8fdc81b4323f97687e071a50b5267496", "norm_filename": "c:\\users\\public\\desktop\\acrobat reader dc.lnk..doc", "sha1_hash": "d36545d6fd09f7c2b574b68e120250347715a28d", "sha256_hash": "ee9058e027d4eb75fc3f979f72db86413401287e4aa18d33e073aed1b1e8547d", "size": 3088, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c685c2f13bbdc51b92da09c4382477e0aeec75af", "file_type": "created_file", "id": "file_46", "md5_hash": "9dcef2ab01e7b4f41c0de6a3df60f5b4", "norm_filename": "c:\\users\\public\\desktop\\desktop.ini..doc", "sha1_hash": "c685c2f13bbdc51b92da09c4382477e0aeec75af", "sha256_hash": "f3f0ac0332a1aadae365c1b4afca95d14e4fb89d56a47ba7582ca72d40aa1cb9", "size": 1120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9b30a2145e9be12747754935fc14661731c1e125", "file_type": "created_file", "id": "file_48", "md5_hash": "5e48a236139104b9b82eeb16cb72e0ae", "norm_filename": "c:\\users\\public\\desktop\\google chrome.lnk..doc", "sha1_hash": "9b30a2145e9be12747754935fc14661731c1e125", "sha256_hash": "19d7b1b55ce79827f37860f46180bddaaaf35dd465eb4daf3098638999ab4ab7", "size": 3296, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0d82d70473b3bcd4d3b1f525f6d86f4e1795dce8", "file_type": "created_file", "id": "file_50", "md5_hash": "ae617e94bd982a4ea563ede72ecdae37", "norm_filename": "c:\\users\\public\\desktop\\mozilla firefox.lnk..doc", "sha1_hash": "0d82d70473b3bcd4d3b1f525f6d86f4e1795dce8", "sha256_hash": "49d51bb8135ae652b9a764971120d484158e06f18efabf29543cd0d6676e57e8", "size": 2176, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5d2c35f8ad96ecda5cebb27ea0f8885656c1038e", "file_type": "created_file", "id": "file_52", "md5_hash": "efa39eb41053ff0a991c991975875bc0", "norm_filename": "c:\\users\\public\\accountpictures\\desktop.ini..doc", "sha1_hash": "5d2c35f8ad96ecda5cebb27ea0f8885656c1038e", "sha256_hash": "5c4d71bd487cd675b674e5774c8cf24bdf86a8dd5204ec75693ea5960d20e216", "size": 1152, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0ab64335840bacbf8cfcf5deaad8cd0ee9f853ff", "file_type": "created_file", "id": "file_55", "md5_hash": "d83dcac774dee521012189dc88cc3662", "norm_filename": "c:\\users\\default\\ntuser.dat..doc", "sha1_hash": "0ab64335840bacbf8cfcf5deaad8cd0ee9f853ff", "sha256_hash": "5dfdb0284b4c5a586857ba6ddf5ac921171130b346bca2ff034c47b7d3a68d47", "size": 263088, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/de37ccf141aa88e2b36823c7f264dad2ef879d13", "file_type": "created_file", "id": "file_58", "md5_hash": "9b22fc5462ac88989eac80428326c8b4", "norm_filename": "c:\\users\\default\\ntuser.dat.log1..doc", "sha1_hash": "de37ccf141aa88e2b36823c7f264dad2ef879d13", "sha256_hash": "0bde45128964856c98d7e041a6f984193f5e2fef9f6e2bae2fece8b8f4dda676", "size": 25520, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d8088abab0fa629c0a2ebd85b09495d004a55eef", "file_type": "created_file", "id": "file_60", "md5_hash": "0e555c1eade9bd288351ec55ece64351", "norm_filename": "c:\\users\\default\\ntuser.dat.log2..doc", "sha1_hash": "d8088abab0fa629c0a2ebd85b09495d004a55eef", "sha256_hash": "13e5d77a28442e6a35c101086e296861f4ea614b314da9d0fa7a9e098a8c7afc", "size": 517040, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/014d993b9c714e98da5f6c99cd385ec74353784c", "file_type": "created_file", "id": "file_62", "md5_hash": "57f5d78a1ec92fde51f041dc00d88054", "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tm.blf..doc", "sha1_hash": "014d993b9c714e98da5f6c99cd385ec74353784c", "sha256_hash": "79d7a87a7868d9fa9c931d396517e6cdcd3f7c6dc3c6ba5110693181eb03fc7d", "size": 66480, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9ec639610f86974fa0f04d099995ab77e3123dd3", "file_type": "created_file", "id": "file_64", "md5_hash": "48edec9d8fe3890abc8a341cf0a24a3a", "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tmcontainer00000000000000000001.regtrans-ms..doc", "sha1_hash": "9ec639610f86974fa0f04d099995ab77e3123dd3", "sha256_hash": "2fa43cfae372a2f004aaee09c314d1641c334862115636da0aa35f5ede3c907c", "size": 525232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/dee459ee5a30f2ff682188a4d33e1c7ef200774b", "file_type": "created_file", "id": "file_66", "md5_hash": "57b2afe19de2c0e01e104353ce5c97c6", "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tmcontainer00000000000000000002.regtrans-ms..doc", "sha1_hash": "dee459ee5a30f2ff682188a4d33e1c7ef200774b", "sha256_hash": "07ea3cf325f425abf86e54b86ec9924ea3c9d1cdc9f3abe1d0d4e4314d7212af", "size": 525232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/234adc81a95746aebf2e5f06f6fc63b13d3b814c", "file_type": "created_file", "id": "file_68", "md5_hash": "1524c23e29ca650fee428d62e876b108", "norm_filename": "c:\\users\\ciihmnxmn6ps\\ntuser.ini..doc", "sha1_hash": "234adc81a95746aebf2e5f06f6fc63b13d3b814c", "sha256_hash": "a9a2ad3c5c92a5dc415de2e8578ca9d214a958f7b46d8dcd988d4503cf9e546b", "size": 976, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5a860bd27a305d6e6af9b8d406836bcdbd0c3d46", "file_type": "created_file", "id": "file_71", "md5_hash": "bd3d4d5eb25d64e78a8dc21a5b0ce4c8", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini..doc", "sha1_hash": "5a860bd27a305d6e6af9b8d406836bcdbd0c3d46", "sha256_hash": "874beff6a5c1aa61d7c49a25dc23a22eb7b0aecf5cb5b45b455afb0f9d8b52f9", "size": 1456, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2f73ba8ed8f14895d10cd2ecdaebe16029c30df9", "file_type": "created_file", "id": "file_74", "md5_hash": "a6d96e199780925d81c91bb4fa149841", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\e2wasdx2n_.flv..doc", "sha1_hash": "2f73ba8ed8f14895d10cd2ecdaebe16029c30df9", "sha256_hash": "2f0627608232265a780eae15074fba5f7be01b0a4c5e41c0446e1d75fe69d9c8", "size": 19616, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6887e6ae6c26e10ef141116a800aaeb571cf40e6", "file_type": "created_file", "id": "file_76", "md5_hash": "869d0badcf60e04ecc2b218ed188b179", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\ibtwm8.mp4..doc", "sha1_hash": "6887e6ae6c26e10ef141116a800aaeb571cf40e6", "sha256_hash": "172284c36a0ac87fb5c30ff25ae5f18efee95ac312fe773b22785c795ff3645b", "size": 63250, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/162bba83fbbfe53f338d365cb2b95e54cdf9bd5c", "file_type": "created_file", "id": "file_78", "md5_hash": "c0d2b4ce573c4b64c6677f6bc37c7415", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\ny17g87un.mkv..doc", "sha1_hash": "162bba83fbbfe53f338d365cb2b95e54cdf9bd5c", "sha256_hash": "79985aa176fd5b4a528a40efbfe9cecbd6cccf6c168123134e4b7566eaae05b4", "size": 74128, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d37b16597503b5bc72dd20ed9b0061565bce7841", "file_type": "created_file", "id": "file_80", "md5_hash": "c4fcb29035a817cc14f45304c4d2490e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\p1l10vzx4hd3-c.mp4..doc", "sha1_hash": "d37b16597503b5bc72dd20ed9b0061565bce7841", "sha256_hash": "4c13bd5c2a840fe2698e48900d9e5a2d225018410104ab0739a6ee816197c36e", "size": 8016, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ad87228795e5c5f35f0beecae9535607c3b6ad2e", "file_type": "created_file", "id": "file_82", "md5_hash": "ef5e1f614a58744f99a63faae1f07cbc", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\u8xibbuo9vcag.mkv..doc", "sha1_hash": "ad87228795e5c5f35f0beecae9535607c3b6ad2e", "sha256_hash": "2f0538dcb5a3fc252bfb660e65f218f482491202bc4cbac19e7f295507c5d1d8", "size": 47994, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a6617a5f0203ea9c75a3012cbae6ab87f497f31f", "file_type": "created_file", "id": "file_84", "md5_hash": "77c363aa0b79f3d0d3668d81ecb9141d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cpccb0b.swf..doc", "sha1_hash": "a6617a5f0203ea9c75a3012cbae6ab87f497f31f", "sha256_hash": "0e02cfb29fea57bc04a3c47f50279cbcd2b82bc0c8e71d36413805de1c73bb6f", "size": 14819, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f00a7c057ca940e40c09389e96080ff1d23300c2", "file_type": "created_file", "id": "file_87", "md5_hash": "2ef50514bbdf5c1fb1d99df1003680e4", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\pgluhotas6kwmmfsdl.swf..doc", "sha1_hash": "f00a7c057ca940e40c09389e96080ff1d23300c2", "sha256_hash": "bc12ad5610ac4c5278903dd2afd1c8c66180a1c519ed54f4c998c8f45124de70", "size": 65471, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/44217fb10c26be8043cb8e1f8995a7a0616d948a", "file_type": "created_file", "id": "file_89", "md5_hash": "224edc872eacbcafe10cc214a8d8f606", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\6e5-hpmrbs.mkv..doc", "sha1_hash": "44217fb10c26be8043cb8e1f8995a7a0616d948a", "sha256_hash": "f88670028a1bc60e4b18741205e4d4a34f8cf076bc2a4d00e4c1e8b55619383f", "size": 11200, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/06f4b83bf0e1cd5fe9a338e2d436627c4f634555", "file_type": "created_file", "id": "file_92", "md5_hash": "7727271b003ab118e5a7ee4f46935aa0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\6gwg.flv..doc", "sha1_hash": "06f4b83bf0e1cd5fe9a338e2d436627c4f634555", "sha256_hash": "6f53372a64e6aa4a87218501439ea4d762b340e2c876ed860b40d58d71b2dd92", "size": 100224, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2293b64dd2a55424b9324ee43e81126f8118e585", "file_type": "created_file", "id": "file_94", "md5_hash": "2c531982707a0d2bf59074d62157b4b4", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\gxfzekk51.mp4..doc", "sha1_hash": "2293b64dd2a55424b9324ee43e81126f8118e585", "sha256_hash": "62dabff92059c12969278fa6d0cd937db0c421bc9bf2d03b1862760d83749382", "size": 86064, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/157b1734ca63de36fba45139b374d21786bbc389", "file_type": "created_file", "id": "file_96", "md5_hash": "cc3026377aba30e4133e5fce0bb76937", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\li6eau1sqq2.mkv..doc", "sha1_hash": "157b1734ca63de36fba45139b374d21786bbc389", "sha256_hash": "47e13837c48b5d49d11675d8e387e57504166d0957c68d17cb5a03cf591e5bd1", "size": 99984, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a5dc55caddf3c00c8ebe8bd5c703256bad2da952", "file_type": "created_file", "id": "file_98", "md5_hash": "22b8453bc206080fbca0de949a9bff50", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\p17xszau6p5nex19v.mkv..doc", "sha1_hash": "a5dc55caddf3c00c8ebe8bd5c703256bad2da952", "sha256_hash": "1600762b28cd5fd906eec2d17dfcaba6fdd1d47cedc7c3e0dca77645667eca43", "size": 80088, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9a0def13f02c4680d9bb499e406ee70049789591", "file_type": "created_file", "id": "file_100", "md5_hash": "0b1b91e03ccdf4eb9f73ee409be5e17c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\qopwqzk.mkv..doc", "sha1_hash": "9a0def13f02c4680d9bb499e406ee70049789591", "sha256_hash": "09c06b2417d218510ae018c5572d9a6e473f7754f6ed606e960d4fe46bbc743d", "size": 15237, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7236a7fc759079d2bb585a4965abbf117ec7b37f", "file_type": "created_file", "id": "file_102", "md5_hash": "3349fa04afe142e3b99cd9812bdbd1e6", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\u-mjrv.swf..doc", "sha1_hash": "7236a7fc759079d2bb585a4965abbf117ec7b37f", "sha256_hash": "3d6909f8e1048412e03a1e0b5a7154a7d7a693b6e95840098229dad9f0637f20", "size": 25264, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/763d4427b0d6e6b2b7ba36516c8b98296b18aa92", "file_type": "created_file", "id": "file_104", "md5_hash": "16c7ee5f1fa526ac4802dc6b46685f2c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\wyrssbqc98w\\jngbvbxt2te.flv..doc", "sha1_hash": "763d4427b0d6e6b2b7ba36516c8b98296b18aa92", "sha256_hash": "307ecdb45c3220a1d9db865e5cd134b219525614fe2c5850504134fa0891b750", "size": 83952, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a5fc0bd86905e48f5f8ebb054463e4671f3213e0", "file_type": "created_file", "id": "file_107", "md5_hash": "8e55130411fb86e461cac2b1786353aa", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\wyrssbqc98w\\xfnky9jskllvnzza0q7k.swf..doc", "sha1_hash": "a5fc0bd86905e48f5f8ebb054463e4671f3213e0", "sha256_hash": "ba3d8c13f3de0bde5ed1a4154c9f8de820891a8234c49417577feb9e2bbdccd9", "size": 67984, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bc138ad598b761a24e0d0013cf64d86dc4fc140e", "file_type": "created_file", "id": "file_109", "md5_hash": "94fbaa99139c9d10a02bfc36ac9de466", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\cn620-gsia4nyyycofj5.mkv..doc", "sha1_hash": "bc138ad598b761a24e0d0013cf64d86dc4fc140e", "sha256_hash": "b1e9c09cf2c3eabc1c4c394d756385daf0ed24b4c23a68d646b660fe6fea512d", "size": 63439, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a10e5dab1ca75408740ce320a4ffa30703ff4855", "file_type": "created_file", "id": "file_112", "md5_hash": "710e3b7a9024eaab14b0f4ca641b75d9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\tt_x88h6 pabcl7r-.swf..doc", "sha1_hash": "a10e5dab1ca75408740ce320a4ffa30703ff4855", "sha256_hash": "f967457c20a83bece1ff8ab326cc7b6354c8f5ca9d37daf0c9511e6a4665faeb", "size": 100320, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c238e5b64433873f13430a7d7210779ac149145b", "file_type": "created_file", "id": "file_114", "md5_hash": "aab7e0c401e157c1c2578244eefe5fab", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\z5nygqlxcnl5cc-.avi..doc", "sha1_hash": "c238e5b64433873f13430a7d7210779ac149145b", "sha256_hash": "8364c334ff92f20ac6b24b1d8bf77b98421d16143a6edab55dc938b2a16743de", "size": 56400, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b4d33f1cf53cecca4886ce8d2dc5e4db905c0a01", "file_type": "created_file", "id": "file_116", "md5_hash": "c3b8766fb80ddf42509e7f761928dc30", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\4tnmmqdfquco23log.avi..doc", "sha1_hash": "b4d33f1cf53cecca4886ce8d2dc5e4db905c0a01", "sha256_hash": "8e61c5186a0dfff841d34d4dedba3589455dc0f82dffb09b3a809403ebf5d29a", "size": 69120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f9b029cc2c1a8d832a6a3db9249ad9a536eb53ec", "file_type": "created_file", "id": "file_119", "md5_hash": "4a6889191bccb24e074c8c8c38412edb", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\9jzc.mp4..doc", "sha1_hash": "f9b029cc2c1a8d832a6a3db9249ad9a536eb53ec", "sha256_hash": "2a526ea714599dcacb6bbbbbd4caba2866f483b2b8484a37a0855db68c9e19c0", "size": 11286, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/df6bea5d708fb2afe2052673928401fd946d62af", "file_type": "created_file", "id": "file_121", "md5_hash": "7ca5c244029c3c8be3219c37cc5c6fa5", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\fwol9dbwif.flv..doc", "sha1_hash": "df6bea5d708fb2afe2052673928401fd946d62af", "sha256_hash": "6face97dd1e3c6aef75551648680b05a670e34e8824462b68d627ccce635e418", "size": 14553, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/65e64716db0da062105d70ba2afa2ecff90fd9c2", "file_type": "created_file", "id": "file_123", "md5_hash": "ba8ccb3fdcee2914c38bce0524e842b8", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\o8eem2rfs_my3eq9rg.mp4..doc", "sha1_hash": "65e64716db0da062105d70ba2afa2ecff90fd9c2", "sha256_hash": "f8d7120d341931fbbcfa46124bd7192f7dbc2f10d5e7d6bc33eee61c5cfa052b", "size": 80536, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cf8d51a8866500327d11a32696c56b6292be4561", "file_type": "created_file", "id": "file_125", "md5_hash": "bd974c8625ad3b525bfcd5bc7ca38035", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\s0d9d09esgnym8fvdwh.avi..doc", "sha1_hash": "cf8d51a8866500327d11a32696c56b6292be4561", "sha256_hash": "19f5df5f700308b91eb93b30ea24fee2c5bc10f2a74a357b97d244d619871097", "size": 10840, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3529e9ca4db6e2dde3252cb17311ffb48bff3801", "file_type": "created_file", "id": "file_127", "md5_hash": "4ae1c4e97f55af4e88994edcace7da04", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\dindjpm.mp4..doc", "sha1_hash": "3529e9ca4db6e2dde3252cb17311ffb48bff3801", "sha256_hash": "a777066c67f3326bd8de19d3d77345345d7ca1e7720329267caf479bc0368495", "size": 84768, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/72fb97c7ca9c532b0d374e13d3edd23528b93230", "file_type": "created_file", "id": "file_130", "md5_hash": "36950664f74e1b45f63a64ad3198c4c4", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\gppag7bkp9yd0gqxy.flv..doc", "sha1_hash": "72fb97c7ca9c532b0d374e13d3edd23528b93230", "sha256_hash": "1a2b8b094e6ad3f6a08229865269e08f1f6b7addfbdf0cc8eb5d2a812e97ac30", "size": 82107, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ac7999e33a532a057f2bc5c5002cce9139377fc1", "file_type": "created_file", "id": "file_132", "md5_hash": "fc1b8206ef863f678da28ae60ff32324", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\gx_wpidl1d.flv..doc", "sha1_hash": "ac7999e33a532a057f2bc5c5002cce9139377fc1", "sha256_hash": "1f314cf51e1aa8b12f451de8f0b25133200e20e8562e8c1e3cddf5305e91e0b0", "size": 75175, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3e0379560c88f8c49c9bf53d4a2567996f17b929", "file_type": "created_file", "id": "file_134", "md5_hash": "a937f1f839db02afb42d1607d1ded6e0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\nxloupbusenpl3p-\\wnvoa3g9jp.avi..doc", "sha1_hash": "3e0379560c88f8c49c9bf53d4a2567996f17b929", "sha256_hash": "4f33edcf69278ac37b940a4eda0741af35ba6b54d261723c27518704e82676f2", "size": 19552, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e60eaf40ee03bb331bf4f80570e2f91048e553d4", "file_type": "created_file", "id": "file_137", "md5_hash": "43ec61be6fd526095167936b71b9c80b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\29fvawn e8kitezwwn.flv..doc", "sha1_hash": "e60eaf40ee03bb331bf4f80570e2f91048e553d4", "sha256_hash": "2e6d24776764e1a69b4cf04bbe6938b2fce888d9e0a4d92086bb7c10ca2745d6", "size": 66832, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1fddce70e9c76b8e19e6a8cdddb037b93816aa9a", "file_type": "created_file", "id": "file_140", "md5_hash": "3608a2b7bad77eb62fa08acc7860790b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\a6mtdotp8ju.avi..doc", "sha1_hash": "1fddce70e9c76b8e19e6a8cdddb037b93816aa9a", "sha256_hash": "4f570434413579e169995ce8070bf8d8532d0e6bb283e81e3a13d01889815f69", "size": 63255, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/576536644a6cd6cef1ebd34f0f61f6332396b24f", "file_type": "created_file", "id": "file_142", "md5_hash": "9592d4228871918fe89dfd41f35f2519", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\ezsh9_u.flv..doc", "sha1_hash": "576536644a6cd6cef1ebd34f0f61f6332396b24f", "sha256_hash": "7f449b69ec6e80ef67ef543350e12f2af51a60d7e5a3a89d404f822ac7c5ce8b", "size": 90240, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9de74aa70b9160dcc0454a2b60cd84c6960635c6", "file_type": "created_file", "id": "file_144", "md5_hash": "9054674649197d9a0c4cff7331c123f4", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\waljyrb.swf..doc", "sha1_hash": "9de74aa70b9160dcc0454a2b60cd84c6960635c6", "sha256_hash": "a4c07abb692ab47758373a5430088a0fdbc7a5328eaac1f0cf8f5d9439b9001d", "size": 63027, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b3d8f3ba307b40c3d24350621282b6a707fee3d1", "file_type": "created_file", "id": "file_146", "md5_hash": "59c24a41d3b59a62c2332684cdf7a2c9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\auvu5oo_3gglwzkk.mp4..doc", "sha1_hash": "b3d8f3ba307b40c3d24350621282b6a707fee3d1", "sha256_hash": "377ae13f6d315cb476f6b2e70531ee2b56e4b479b8afe2a0e4f7d50329c91673", "size": 17536, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a0d8bdccfeb75d91c92c37ef9c8e27270ca66123", "file_type": "created_file", "id": "file_149", "md5_hash": "998056d7bb4782afc1fe5dd83831b349", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\kmleb81ee9b5n1x.avi..doc", "sha1_hash": "a0d8bdccfeb75d91c92c37ef9c8e27270ca66123", "sha256_hash": "e57bb617df558bf06851dbead8bb94a488a7d59f0585d9b6d303737e76212765", "size": 36512, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8e2afec244434d71356ce99f54eb2a060b186fd4", "file_type": "created_file", "id": "file_151", "md5_hash": "afbc6aae9a38e174bba006c3eed12fb1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\nmno7w-y-y.swf..doc", "sha1_hash": "8e2afec244434d71356ce99f54eb2a060b186fd4", "sha256_hash": "d722f4cc88e9845f795364929d9a39dfe3dceeb94a6178c498d5fc984797d047", "size": 56592, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2ca70859374af74b538e9d2dee9aa5c6f07076a4", "file_type": "created_file", "id": "file_153", "md5_hash": "08cf7a35d11c46ef9f2636134600a86d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\fvnqxqgywua5.swf..doc", "sha1_hash": "2ca70859374af74b538e9d2dee9aa5c6f07076a4", "sha256_hash": "d7207d75687dcc2265408367f777e000e2ca602cc61940275efa6bc1dfbae30a", "size": 87360, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8f78ef7d1c1cc1458b83ac4f6f845449a9464bf9", "file_type": "created_file", "id": "file_156", "md5_hash": "3f0d9b18e92cddfe21eb116820e72a56", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\inom_uv1i78k.avi..doc", "sha1_hash": "8f78ef7d1c1cc1458b83ac4f6f845449a9464bf9", "sha256_hash": "dd2ce7ba60461cb0302fc03576843773928d1fc4d13cf480ca79c2b516825a3d", "size": 72032, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/53ed9157075b7aa18ee2abec0419a623c4acd2a5", "file_type": "created_file", "id": "file_158", "md5_hash": "df53e775ef95e9d4c47ff79c72935cc1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\l6wybm_d_r_.mp4..doc", "sha1_hash": "53ed9157075b7aa18ee2abec0419a623c4acd2a5", "sha256_hash": "58c9eb8125df9d1653c419f73e3dc5d0528682a8bd74a47209ba75802c678fd6", "size": 63433, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f53b0cc38d4f8c6b30926e357e63d6cbe5d5166b", "file_type": "created_file", "id": "file_160", "md5_hash": "c4c1f7faeaa84afea0455e3ad7466095", "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\desktop.ini..doc", "sha1_hash": "f53b0cc38d4f8c6b30926e357e63d6cbe5d5166b", "sha256_hash": "7fc129f00a30303e0fae704350f13d9534be76909e6961261677e3b75d960a80", "size": 1472, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/db060cce54618b30a81ef32e3ab32413cc98df51", "file_type": "created_file", "id": "file_163", "md5_hash": "67a89b1d4df7926bb1282fa543e092f0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\everywhere.search-ms..doc", "sha1_hash": "db060cce54618b30a81ef32e3ab32413cc98df51", "sha256_hash": "0f7ad004fc0f95aea113801039197f9c33c45f1953356bb603ab97c109396cd3", "size": 1200, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c7fc75a79d8556a2c8862f39a7bd13df6d800be1", "file_type": "created_file", "id": "file_165", "md5_hash": "9f661fc1d668f3df14e769547e7beee1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\indexed locations.search-ms..doc", "sha1_hash": "c7fc75a79d8556a2c8862f39a7bd13df6d800be1", "sha256_hash": "e81325733aa1be43630ecd9a9cba0cc6e69b9bf71ac8262233e05e8500eb5cdc", "size": 1200, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fca1d2e592d8698781d386f7ce2d310384c5853f", "file_type": "created_file", "id": "file_167", "md5_hash": "d2c3bc6c2e874a4e62d5752742d6a26c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\saved games\\desktop.ini..doc", "sha1_hash": "fca1d2e592d8698781d386f7ce2d310384c5853f", "sha256_hash": "2268250d88125d513d73334d7ecfd5c0ec075c5639646ac99e17bf8220e96c67", "size": 1232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e43e831e8a6648909cc0480f02a6a1423f148ca2", "file_type": "created_file", "id": "file_170", "md5_hash": "ac9f3f9c26338af80c9ba05a1b5f64b0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\0hk3ferwlwmdegnqx0.gif..doc", "sha1_hash": "e43e831e8a6648909cc0480f02a6a1423f148ca2", "sha256_hash": "d2688170b4418761121d914e2c7573fbbe6b326b9544be772c99d3ae547efbe1", "size": 25917, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4a2c061fc5e340860ab6b2f16d5f2ad1d62e2e82", "file_type": "created_file", "id": "file_173", "md5_hash": "2dbb0b4cb0b8acf258f575c13848af0c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\7qdjrw-yomo-k-z7n.jpg..doc", "sha1_hash": "4a2c061fc5e340860ab6b2f16d5f2ad1d62e2e82", "sha256_hash": "e6dfb245a478614c79c30c89345670b51f6182c37bccc7ce258d19076ebc8d4c", "size": 7280, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c9b06d0f911c553a516f1e3066fcd1f3af08a473", "file_type": "created_file", "id": "file_175", "md5_hash": "3dbf9c15339199ca1e20853ace4b31d4", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini..doc", "sha1_hash": "c9b06d0f911c553a516f1e3066fcd1f3af08a473", "sha256_hash": "4d8b6c410fde466c6a91419bd42ff117b20a0142ecbf655f2b5c7e18e2b30157", "size": 1456, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8245ac00ca2d1977b65a96d15aa601001ff58199", "file_type": "created_file", "id": "file_177", "md5_hash": "7caf7deb64e49cce7593c857445d9707", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\h7trdzq_5g.jpg..doc", "sha1_hash": "8245ac00ca2d1977b65a96d15aa601001ff58199", "sha256_hash": "6bdc520d1fa0813a5849e335f463903b59082bbac8a66c5143c26cd9b539fcb9", "size": 24352, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ca910c5addc99824de22d683676ab0e7bbd0c802", "file_type": "created_file", "id": "file_179", "md5_hash": "bef17db6f8008201e2eee7fd8215e509", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\qrw9a sahnuzyrbroxd.png..doc", "sha1_hash": "ca910c5addc99824de22d683676ab0e7bbd0c802", "sha256_hash": "6255803a4dd36fa4b6b32c5152151fb9414794203bcd7b676c79d12731a1cb03", "size": 52672, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/339bdab658b3cee4b1dfbd555d67b97fa002a177", "file_type": "created_file", "id": "file_181", "md5_hash": "6221a08d21072faca2c26a7097305663", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\qtvkcwkzzwibwteiqbm.jpg..doc", "sha1_hash": "339bdab658b3cee4b1dfbd555d67b97fa002a177", "sha256_hash": "f5ff60ac82babbb8ea59c7690f6ed00abbd182317eef555b0864a53b2e802b3d", "size": 86848, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/791af3ac7e44f90ef0aa93c3c6aed09210b47f19", "file_type": "created_file", "id": "file_183", "md5_hash": "cb536c6ba05ad084eff49534b411798c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\th8eu.jpg..doc", "sha1_hash": "791af3ac7e44f90ef0aa93c3c6aed09210b47f19", "sha256_hash": "616f462f32179ebad3ccc620412868de4ff8653e13f2a0f3407afc4c3d4707d1", "size": 64444, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2b1d5c41a36841dce08c429493aa8041277a6029", "file_type": "created_file", "id": "file_185", "md5_hash": "6ffd4e7f9b56f035a66f15814759b63a", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\xphr2tjjz.gif..doc", "sha1_hash": "2b1d5c41a36841dce08c429493aa8041277a6029", "sha256_hash": "3271d5f78d0e0a9d15c4c0434ae1beaab48fdbe953f649d7be9dfae66fce2f7c", "size": 91024, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/66ef0c636edc9f29d4ccf63034dc37e8ebf88ec4", "file_type": "created_file", "id": "file_187", "md5_hash": "b0d042871f93477b4b37c70d7629837d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\desktop.ini..doc", "sha1_hash": "66ef0c636edc9f29d4ccf63034dc37e8ebf88ec4", "sha256_hash": "af01d088ccd7258d620311b66d6308413f9a5b618df0a162b66461913890d241", "size": 1136, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a886b4e80fd4f7e4e1c6f891c045b38ab0997118", "file_type": "created_file", "id": "file_190", "md5_hash": "a8594fdd545b6bb17c417f4873165714", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\-9fnhcfha2.png..doc", "sha1_hash": "a886b4e80fd4f7e4e1c6f891c045b38ab0997118", "sha256_hash": "748f2bbfb8824b5e10ae6479c549f6f69647d25377479cf85b58529ddbae894f", "size": 27223, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/46e1f7efd4a53808d430e12adfd8728f315abd60", "file_type": "created_file", "id": "file_193", "md5_hash": "cba8de21ea1a126cfdc94024e40f0f55", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\9xuhi63.bmp..doc", "sha1_hash": "46e1f7efd4a53808d430e12adfd8728f315abd60", "sha256_hash": "f4d65c1671191464475c8d6c7f61bf0d8fe07be14bbb27977cc3670f0612445f", "size": 53504, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/982c5debeded46dfe4e4a251971702301159bbca", "file_type": "created_file", "id": "file_195", "md5_hash": "12d9125b7719dd59f98119fcb76c7cde", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\hkqhg.png..doc", "sha1_hash": "982c5debeded46dfe4e4a251971702301159bbca", "sha256_hash": "046e39766f992c5785cc76142a09abe4fd9b305a4a0e0140a6c8370b455740f3", "size": 55008, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6b3b47784a3652ac50e44ac130d71389ea8a1e0e", "file_type": "created_file", "id": "file_197", "md5_hash": "30578e80f0a80370a8c6d465f0b1a195", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\qhasofurdpjwbi.gif..doc", "sha1_hash": "6b3b47784a3652ac50e44ac130d71389ea8a1e0e", "sha256_hash": "b930acfbd9d9b5cef9f2e53d1c84765da1a6990c42e78fe247e944fc3df4caa5", "size": 98657, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f0db99e5d5cfc01b857635cd9a84645f36ddd0df", "file_type": "created_file", "id": "file_199", "md5_hash": "5b0b91210560fe6519b94a7b619c691e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\x1b_.bmp..doc", "sha1_hash": "f0db99e5d5cfc01b857635cd9a84645f36ddd0df", "sha256_hash": "9c64bffd9d021a4292cc55882a66fe3c6b7b7f4288fe1fba6603618de6168d0f", "size": 36880, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d040eccbbb921c559a00c81c2c9ef27f7a858bc4", "file_type": "created_file", "id": "file_201", "md5_hash": "5e79772c1bf60f453460c5abc32d5257", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\as7lziutzivnqsdmixnj.jpg..doc", "sha1_hash": "d040eccbbb921c559a00c81c2c9ef27f7a858bc4", "sha256_hash": "52e64a74db7f147f4477d73874694bbdc93daf35f83e04fdefd806236b6098b3", "size": 36528, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a798f721381034bebe68604bdbe2a66366a29705", "file_type": "created_file", "id": "file_204", "md5_hash": "0539fa8eac70342f38f39a2aff0b53b9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\d_fv7 prsx.jpg..doc", "sha1_hash": "a798f721381034bebe68604bdbe2a66366a29705", "sha256_hash": "94e9f7d040b6f5608c78adbae3b61bd895e3b49e7edc0f97b227d620aa2eeb47", "size": 33655, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9015b1b9c7d81a959e33946dbc4bc036cc7a4457", "file_type": "created_file", "id": "file_206", "md5_hash": "53ba80cd0472f0698fd1aae0d73ae925", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\kovnpdmyrl.png..doc", "sha1_hash": "9015b1b9c7d81a959e33946dbc4bc036cc7a4457", "sha256_hash": "48f027c9baf7222c23df41960d3780f75b4f169640f35b92be2cd2651c96a3ce", "size": 47647, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c97904a3ff6a9e73ad38051e05e87decaba9a221", "file_type": "created_file", "id": "file_208", "md5_hash": "077d2fac723f1cbd3d6bdfc1fcccc4b7", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\ugmctukfcxobe.png..doc", "sha1_hash": "c97904a3ff6a9e73ad38051e05e87decaba9a221", "sha256_hash": "7d919692580b8bd577a1360c5506249a580d1ffb78bc03f2cc07ed3f6a7e4f9f", "size": 96079, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/22ddf8d15fc919b28ac880548c7fbf0d4b8aadb5", "file_type": "created_file", "id": "file_210", "md5_hash": "ff38a4f3373f37969a54c7ceb6223b9c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\ulsdcvkqeuxlv ur2xy.jpg..doc", "sha1_hash": "22ddf8d15fc919b28ac880548c7fbf0d4b8aadb5", "sha256_hash": "de26b309e0ba1723040055c01ca175326fdb25658c5d4f2678435b16772834b7", "size": 46756, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8ab4945701ba3219e2ffdb58726d345c4dd79d48", "file_type": "created_file", "id": "file_212", "md5_hash": "5cca10bd6c111274005acf6f8db9d76b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\desktop.ini..doc", "sha1_hash": "8ab4945701ba3219e2ffdb58726d345c4dd79d48", "sha256_hash": "bd7dadad415f1e07336a09ada99a12632c47dcf7fb5a6de72ab9eaa5044856ef", "size": 1136, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/50d754005ca12f35030bb9fba64998c17f460fa7", "file_type": "created_file", "id": "file_215", "md5_hash": "e91fcc5a22a514f23ab756ab8e965e88", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\3kc4ze4gwjhznr0zwjv.png..doc", "sha1_hash": "50d754005ca12f35030bb9fba64998c17f460fa7", "sha256_hash": "d05103743b01d72da17f90cf0c1216ca7a9e01164df05337456444675c02b070", "size": 63753, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ba1d212d9e0133221334f84effe4ede67597d01d", "file_type": "created_file", "id": "file_218", "md5_hash": "af89d4843dfef53adccc8dc0ef2a8934", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\8fsdui62a 2pmyacyjt0.jpg..doc", "sha1_hash": "ba1d212d9e0133221334f84effe4ede67597d01d", "sha256_hash": "1131be65c1eba551c686f4ddbf5edd84f43f0b8720513530dea691e502479026", "size": 12325, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fd31cbdc91fa71fb9f18e29dd506905f0d5ea307", "file_type": "created_file", "id": "file_220", "md5_hash": "97f431bcdb02fb152c69f0fe02419e3a", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\9n-4.jpg..doc", "sha1_hash": "fd31cbdc91fa71fb9f18e29dd506905f0d5ea307", "sha256_hash": "760a7a2b099cc37d79aca7c4a44fdb8a970d0224b4f69ba64fe2f3f0bf797eb2", "size": 17568, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/79effbc7a1827648436550239433a1bed1ac4f69", "file_type": "created_file", "id": "file_222", "md5_hash": "d7bf4fbff69ac4313be002d49c76f39c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\baym9st _guc-pmf1k-.gif..doc", "sha1_hash": "79effbc7a1827648436550239433a1bed1ac4f69", "sha256_hash": "1674d71148be864775ed3c1c68f6b6ade5ad27d3abc77314c90e6c00a5df3a51", "size": 89568, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/01408887f8b4fca7dcf925b8245e4c15a2515a96", "file_type": "created_file", "id": "file_224", "md5_hash": "542c2e3411ca3a681549cc1a98856d67", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\dy4knw.jpg..doc", "sha1_hash": "01408887f8b4fca7dcf925b8245e4c15a2515a96", "sha256_hash": "58b689bb52fd767c33954049f14b10c91a6a5e148eb8104127d0161ad3a94b62", "size": 25056, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2219754d4bd725d44bf411c526c41480bc120186", "file_type": "created_file", "id": "file_226", "md5_hash": "77fd1a6a20182d86d798362c119dc482", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\gfe4.gif..doc", "sha1_hash": "2219754d4bd725d44bf411c526c41480bc120186", "sha256_hash": "1b378dd060e864fec50e1db866c4ecd212f948212c33fe804da903e8c2afb62a", "size": 43699, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/67d2f2dbdd9e52832ee21483d65b390ca534c5a9", "file_type": "created_file", "id": "file_228", "md5_hash": "599d1503d5df5884c705682574796908", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\l6xswm755meyjgkn.jpg..doc", "sha1_hash": "67d2f2dbdd9e52832ee21483d65b390ca534c5a9", "sha256_hash": "54081f08d706f60074bdef6e7f8d10c61d2a80af9c9ba8378c7c2113ac986d44", "size": 33679, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/42a4788a39c115d40c18c403c17c08927ffee412", "file_type": "created_file", "id": "file_230", "md5_hash": "bc53f8db3d2219662d16428f33bc9c3d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\olgvhwydqyi0lakbu.jpg..doc", "sha1_hash": "42a4788a39c115d40c18c403c17c08927ffee412", "sha256_hash": "5ebb588dec0ad24e05480a2eae6bdbd0ad2650eb2b6e1447587cb65aab269859", "size": 63956, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e365174a03247c97fc9ee07248498d3f860b80a0", "file_type": "created_file", "id": "file_232", "md5_hash": "4011b193c3ea477cbdb7878b5e6e4ace", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\rjzgheo.jpg..doc", "sha1_hash": "e365174a03247c97fc9ee07248498d3f860b80a0", "sha256_hash": "ebe9f6bcf0406f51ec1360024a0baf809abfc4cfa9c8f54e2acf6545eca4a6fa", "size": 74272, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/62aa0ee530b1684ac4a3308d1a226c8a2b999a45", "file_type": "created_file", "id": "file_234", "md5_hash": "bf95a5b5530da4c567c457a7405ebb09", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\5b opcyk dpcoz.jpg..doc", "sha1_hash": "62aa0ee530b1684ac4a3308d1a226c8a2b999a45", "sha256_hash": "975f8a21e4602b9515be89d331d38b1155f9259adc53e09f3e47707f91236b48", "size": 67648, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ff225983c83fdeac6d24e00bc28690dd9ebc0d23", "file_type": "created_file", "id": "file_237", "md5_hash": "4c7f676d50a765b1c881721991fe70a9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\epxxkihhqhnuu6fk.png..doc", "sha1_hash": "ff225983c83fdeac6d24e00bc28690dd9ebc0d23", "sha256_hash": "cfecb0949cb1b424b3b14aade255d501e8960e263d3a5311e896ed045f6374ab", "size": 101872, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cc287a3da490d7e841759a957fdec13e4cd82e2a", "file_type": "created_file", "id": "file_239", "md5_hash": "5ff39262daafd22d49661e9bbb4937fe", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\ptut.png..doc", "sha1_hash": "cc287a3da490d7e841759a957fdec13e4cd82e2a", "sha256_hash": "796c0c58d34b7be60b69345a52494b8f3ff6261ae18323719503e17a125350f4", "size": 8000, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f35051ec0f0ee9850b1defa2e76b16027bb25166", "file_type": "created_file", "id": "file_241", "md5_hash": "928d739af09a9f89057dbc12faeb53c2", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\-5ln7dorug9.png..doc", "sha1_hash": "f35051ec0f0ee9850b1defa2e76b16027bb25166", "sha256_hash": "1a1169bfb1d5c2c7dc22af9cf6bd0745973a62b94c2b415598c747335a0996a7", "size": 47358, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2cabfec4627b0f99dc431fc378822716385c6030", "file_type": "created_file", "id": "file_244", "md5_hash": "1ab1ac77b6519d6d5e64284749dcb175", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\f0xhzrypqok3ky78oshs.png..doc", "sha1_hash": "2cabfec4627b0f99dc431fc378822716385c6030", "sha256_hash": "00765bc7e24a8493a7d6b86414551b3ba60a33561f631a3623b61aea3c578696", "size": 47307, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7c511012208b5d52b8610795bc4519f2ada50ab2", "file_type": "created_file", "id": "file_246", "md5_hash": "b44ff50eb8a7d805974b9d748c93fb52", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\i39wbfumyp6nr8z.bmp..doc", "sha1_hash": "7c511012208b5d52b8610795bc4519f2ada50ab2", "sha256_hash": "ef5a76511fdbdd3bee2f4d07fad1cf1a1a805be55af41705faa2daa9daa51996", "size": 93263, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2535230322be3bc8a95c223aed64435dfead5cc6", "file_type": "created_file", "id": "file_248", "md5_hash": "f0bf7f7c785877b62a459ffb5e32ebe5", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\mazf5-.bmp..doc", "sha1_hash": "2535230322be3bc8a95c223aed64435dfead5cc6", "sha256_hash": "118fb7d5ede3c8190d5bb77935b2e3dd7026a03279099e7cdb00b1ff89b374c2", "size": 38032, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e8a412c9f56fbe883167bd6ead7bfbd42fe9d44f", "file_type": "created_file", "id": "file_250", "md5_hash": "04b3c7e69561c2888e7a5b84ab9f6d59", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\tlhdeof6pkj-_rumjy.png..doc", "sha1_hash": "e8a412c9f56fbe883167bd6ead7bfbd42fe9d44f", "sha256_hash": "d87875105600cd1c0aace4d8bf777135cc51328c22b204a295090c9a68e6bb7e", "size": 102576, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/75676b5f9d301b1e37d5c1dc2ee5e82cb9ef5045", "file_type": "created_file", "id": "file_252", "md5_hash": "786713f927ab73bf30c7519cbc9a0544", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\tq6halxmym.jpg..doc", "sha1_hash": "75676b5f9d301b1e37d5c1dc2ee5e82cb9ef5045", "sha256_hash": "4be5ad07ac1aa15652184451374b3b874826fb2d72643211aab4b92a94f8aaed", "size": 40752, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/dcb6b5f5d6420e92473415630a11c074c865fb1d", "file_type": "created_file", "id": "file_254", "md5_hash": "f9684a45f6842e4b1cc3d62a8aca8d0c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\6ghfbg6r\\ydgp6n.jpg..doc", "sha1_hash": "dcb6b5f5d6420e92473415630a11c074c865fb1d", "sha256_hash": "d5d0e1ac0f2c1b53ffab0344f4f54556ee059759fa7e64d61a8f952daa9458a2", "size": 30010, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e5f5c7cf7b6d6e5ae349dfb6fb2f02f95130a79c", "file_type": "created_file", "id": "file_257", "md5_hash": "0072fd5678c831e896556403c9a56dc5", "norm_filename": "c:\\users\\ciihmnxmn6ps\\onedrive\\desktop.ini..doc", "sha1_hash": "e5f5c7cf7b6d6e5ae349dfb6fb2f02f95130a79c", "sha256_hash": "cc05acaabf026ed6bcd29908ae5079735617583855e4fd6557d8e310154af02e", "size": 1056, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/250d53eaf9025c4559cdaad0b27f7ed435f1a782", "file_type": "created_file", "id": "file_260", "md5_hash": "2c90f23fd3114719e5dbaa82caa89f90", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\-gv6hl.mp3..doc", "sha1_hash": "250d53eaf9025c4559cdaad0b27f7ed435f1a782", "sha256_hash": "ebb0613399cc729b99177b5ebec4f245500a6e66ab9a052f92910d6937d6f691", "size": 5952, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7d348ab645d083ceed008810414fa7ef7a44e201", "file_type": "created_file", "id": "file_263", "md5_hash": "b0fa6eab862c042066dc38fad71cabef", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\a7bhmqqgp.wav..doc", "sha1_hash": "7d348ab645d083ceed008810414fa7ef7a44e201", "sha256_hash": "4fef77b6c8e7f4996e016a4e24c274e0000ee2e3f7efd1035b233bef8ab84ed4", "size": 32862, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4ca5f47e27d62693879f719b542b2904b0563b56", "file_type": "created_file", "id": "file_265", "md5_hash": "c97099a5ebbc80d50d309d865880682c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini..doc", "sha1_hash": "4ca5f47e27d62693879f719b542b2904b0563b56", "sha256_hash": "ad3c0c99182392975db23272978191ff9571c70e703c03a405338a777fc58be2", "size": 1456, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/dc9544ecd70bbde7a47e1c8e0566a7cd56a77d93", "file_type": "created_file", "id": "file_267", "md5_hash": "0c76019d1dd59733e76144c42f6bab95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\fgplqzx t.wav..doc", "sha1_hash": "dc9544ecd70bbde7a47e1c8e0566a7cd56a77d93", "sha256_hash": "b58d31ec4f4db1e03b94ed836f0da1d41d8e7372525d6496b5ebfd8e132bafb9", "size": 95312, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/293f8367e9af5a7fdc6c0236488f35e37d4efe47", "file_type": "created_file", "id": "file_269", "md5_hash": "b007a5506f60a4dd110bacf3020a385f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\dckf.m4a..doc", "sha1_hash": "293f8367e9af5a7fdc6c0236488f35e37d4efe47", "sha256_hash": "553dbc1b733af0c76ef0c3f3c7e922952243f6369c0d1ad8466168573233207e", "size": 29808, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1b5493aa25f317782189d937ad5ad82a9559a407", "file_type": "created_file", "id": "file_272", "md5_hash": "e4093144803c7ad006ee5d2eae5cf5b7", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\dsupk7zl9jc7_qd.wav..doc", "sha1_hash": "1b5493aa25f317782189d937ad5ad82a9559a407", "sha256_hash": "7b515183cebe5db526924ac367d388c1b837ab659c206cd5b099496a656cc2a8", "size": 21696, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/368a7817564586557f049a96d4f24a32ddb462c7", "file_type": "created_file", "id": "file_274", "md5_hash": "f0ea0deefa136587fc6a510b1395a251", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ippvcsepbfwdelc.mp3..doc", "sha1_hash": "368a7817564586557f049a96d4f24a32ddb462c7", "sha256_hash": "b8044b5eda6fbb828bddf30c03b8139cb8305c0d586d4b85f6e609ccc082259b", "size": 71968, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bba3aabb49cc0b4117c0b02e9cbfbe2aba2928f6", "file_type": "created_file", "id": "file_276", "md5_hash": "f27d09d9b1f2a01da155b43943031bca", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ozuwudusfqn.m4a..doc", "sha1_hash": "bba3aabb49cc0b4117c0b02e9cbfbe2aba2928f6", "sha256_hash": "ad5581fbde71925b779c79b29baa5e2c9979765981b5bfd5a363769352d45b4e", "size": 33572, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e78532985ce0a17447226d5d6529395226052e9e", "file_type": "created_file", "id": "file_278", "md5_hash": "ac7657ac37ab2dad3dede5f0bb1907d1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\vnzuuijun.m4a..doc", "sha1_hash": "e78532985ce0a17447226d5d6529395226052e9e", "sha256_hash": "7dec2fd091ed96b53bdb35ba628a2e527e75c675c448c52eb05cc1f1f8709102", "size": 89760, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bcd5d2cae4b888848a90ca8a63b37c4c2050c095", "file_type": "created_file", "id": "file_280", "md5_hash": "6357bc54149cba544428784c0433f230", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\1fc6vhdhwaiuxr.m4a..doc", "sha1_hash": "bcd5d2cae4b888848a90ca8a63b37c4c2050c095", "sha256_hash": "abdb19f2f52b16492433c58b4f3f92079aaeac3298aed2feadeaa188e07db67b", "size": 50944, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9cbbc6031e6808017669df470bb7a2e63f519f5f", "file_type": "created_file", "id": "file_283", "md5_hash": "58feeb6c0a8d6b8c0ff50d78f28885e2", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\d0i5ilhq2cc66s_ealg.m4a..doc", "sha1_hash": "9cbbc6031e6808017669df470bb7a2e63f519f5f", "sha256_hash": "608c971dfc4e0319f8e435d89976c085c51bbcfe137b7b7960a0fa7c2d5897b4", "size": 97408, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/aee3d0171814ba4e53f0868835b27937873dc417", "file_type": "created_file", "id": "file_285", "md5_hash": "733585550054dc6ed95b4ec83420b6f0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\esxi.mp3..doc", "sha1_hash": "aee3d0171814ba4e53f0868835b27937873dc417", "sha256_hash": "1343c6dcadfb0d04b39cf0260b68f5ab7b4dabbff0ee7c9fd5efd9b6c3932b40", "size": 82270, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/76cb14460a77226515cac081e58ba731df533f49", "file_type": "created_file", "id": "file_287", "md5_hash": "41e5deb048024ef38b94630c5223d365", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\ew3rsnw.mp3..doc", "sha1_hash": "76cb14460a77226515cac081e58ba731df533f49", "sha256_hash": "2069c416c8c16ce33d9b02a204f4194825afec85e895221cf0cafe7e7e8655e7", "size": 48455, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/90d40ce6670dce890cd09d346d68589b5b03ea9c", "file_type": "created_file", "id": "file_289", "md5_hash": "0fb34c7d0f053d21d608b8ea277b28c9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\i42jovpae6wr.m4a..doc", "sha1_hash": "90d40ce6670dce890cd09d346d68589b5b03ea9c", "sha256_hash": "a6f18da0473a435fd9b31667fa1ebe8e5db1d75f7f44ce1b50a7c7bc9cfe11a0", "size": 33215, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0d53566be4a391be7fd715af4f31941e4734803c", "file_type": "created_file", "id": "file_291", "md5_hash": "fc490dee92d7ba28af2adb66db5aca54", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\k4en3jl_.m4a..doc", "sha1_hash": "0d53566be4a391be7fd715af4f31941e4734803c", "sha256_hash": "d17ed4b8b9c6579694c17462c1f333a4e22b46a4295a3371e3574098cd62a4af", "size": 78963, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/50c9348cb4ef95a6400be8c1a87e9d15ee4c805e", "file_type": "created_file", "id": "file_293", "md5_hash": "5d845b1ddf14fd713ba167b947d98559", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\oc7nraysldll.mp3..doc", "sha1_hash": "50c9348cb4ef95a6400be8c1a87e9d15ee4c805e", "sha256_hash": "4fe8205178e31f39942f682e989f0b38661366393ee36e9dc259474709c46f13", "size": 13797, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/db1c51175b3e42a1fd0f2adecaf54c364c036438", "file_type": "created_file", "id": "file_295", "md5_hash": "92d8cb8ebee0bb258d0ff45bba2bb6b7", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\605wo0ig7rv 5gkzsb.mp3..doc", "sha1_hash": "db1c51175b3e42a1fd0f2adecaf54c364c036438", "sha256_hash": "b6077ff7a2a3ba47b36a1db551aaa36cb0d2e47f679429bf0550b60bd3429903", "size": 102544, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5ced5c633cd764396f3a66ebb33d70580c85d05f", "file_type": "created_file", "id": "file_298", "md5_hash": "a04e323349b77ad51775718d94d07295", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\m1rlmk2akfhdrfd.m4a..doc", "sha1_hash": "5ced5c633cd764396f3a66ebb33d70580c85d05f", "sha256_hash": "3452a2c547fa86a8458aef3b7df4401e93e4881d2d4ac252d3a78997baacca2e", "size": 29400, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9eb3ce342b9865c336423eb839a1ae6568e87c31", "file_type": "created_file", "id": "file_300", "md5_hash": "b00326eb8d130047caf56c0246925ae6", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\pgszj43skzy.wav..doc", "sha1_hash": "9eb3ce342b9865c336423eb839a1ae6568e87c31", "sha256_hash": "6e315628f59f2919f8329c624e822f963db94a8c92a5316a6509b5922ec13ce0", "size": 77311, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c24f5f84cf5b6027643abdb0b74cd3285f2c3507", "file_type": "created_file", "id": "file_302", "md5_hash": "8d82a8ffae788d669b9ddcb04b39e04b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\yx7ef.m4a..doc", "sha1_hash": "c24f5f84cf5b6027643abdb0b74cd3285f2c3507", "sha256_hash": "addfb6544509b015e79c673160ee3a6a393fe52ed68c442f13f37c7d811a1339", "size": 81512, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b2ae5640ce2ca2aa9d3cba017b0dba6fa76da4a1", "file_type": "created_file", "id": "file_304", "md5_hash": "21afe0d57dab129e4eeb2e0f8e9e09dc", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\lce5uuov6td.m4a..doc", "sha1_hash": "b2ae5640ce2ca2aa9d3cba017b0dba6fa76da4a1", "sha256_hash": "7b699621de7ead27680c2377132ad87d45f5d012aefddf3e1d5c8047f5bfa917", "size": 67168, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/259d3d85b41f3dffbd7a4ce1fdc551d2e574bc05", "file_type": "created_file", "id": "file_307", "md5_hash": "aaafcd348ec71e590e2674469356ab02", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\vapnw9bykw_hbbp.mp3..doc", "sha1_hash": "259d3d85b41f3dffbd7a4ce1fdc551d2e574bc05", "sha256_hash": "91469c74b9970b2e4165a35e9ffcaefd5436e46e62aae2f9cd28239595240a08", "size": 34416, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3e638590c658fe9271f7477afe57ac074206fc65", "file_type": "created_file", "id": "file_309", "md5_hash": "4b8778a5461ddfcf01ea1ffa74ea30da", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\x9tnf17hn1x0_ekcrc.mp3..doc", "sha1_hash": "3e638590c658fe9271f7477afe57ac074206fc65", "sha256_hash": "16cbb794377ac9e0e71a9f831909d91f264fbd8422c7bcec1abbf2eaea76f31d", "size": 28919, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ef5af09875614c367f09e0dc4e64ba5f42b108a5", "file_type": "created_file", "id": "file_311", "md5_hash": "bc1906627c022794f5083fa1e9d4e445", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\tfeyyxaopweg\\jfdazs.mp3..doc", "sha1_hash": "ef5af09875614c367f09e0dc4e64ba5f42b108a5", "sha256_hash": "535dc7348f9508a832322bae74043c27fd59e5a4599414213f0b8a2cc3b8bcbe", "size": 5632, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/374f1e1b03d2823d1ff6ed9b88bc358e4fb4ffe1", "file_type": "created_file", "id": "file_314", "md5_hash": "0742e8a807ed2e32afa17686ec6dc692", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\tfeyyxaopweg\\pm7otm.m4a..doc", "sha1_hash": "374f1e1b03d2823d1ff6ed9b88bc358e4fb4ffe1", "sha256_hash": "e9bb179e71217f4746c63941d9a67f59bbe38ce7de4a4915e5e85698f1713001", "size": 15248, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/78712f3c9015a24e34501d4c8ae43ee5d8c8e0eb", "file_type": "created_file", "id": "file_316", "md5_hash": "6f6e2ecf0db7360f0afa5728831559b0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\e 0yavcuvr4xtgj0s.m4a..doc", "sha1_hash": "78712f3c9015a24e34501d4c8ae43ee5d8c8e0eb", "sha256_hash": "45c7f50ca9507476362466b3479653a594b24af40b6f24a50c80f8c6ba341e36", "size": 64152, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4f6d8b6496fa017b30da91e5458de9793087710a", "file_type": "created_file", "id": "file_319", "md5_hash": "c9bb8b82d67c18188946bcede0643e96", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\i30gioixb.mp3..doc", "sha1_hash": "4f6d8b6496fa017b30da91e5458de9793087710a", "sha256_hash": "153ddd4d181120b7dd545a44dad7dd2c4be1cff9c5889dd29b13db6e55e12aff", "size": 61997, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/86233756e704378370f81a345f646e9ff955ea88", "file_type": "created_file", "id": "file_321", "md5_hash": "ab1d36c557cd637ebc23b477c76d6c1a", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\ikm7 z01-mol8cw-v67.mp3..doc", "sha1_hash": "86233756e704378370f81a345f646e9ff955ea88", "sha256_hash": "aac3772f64ce5e546a77ed492e4ac3ed20ffb62400871d1c062f40ed6d2c5f82", "size": 62468, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b201e0f59f05cdaae03c84ec51a47080c5e0084c", "file_type": "created_file", "id": "file_323", "md5_hash": "427a283595977e77ae73ff64ca7f54fb", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\mrwbv.wav..doc", "sha1_hash": "b201e0f59f05cdaae03c84ec51a47080c5e0084c", "sha256_hash": "3d30b015795eb0cfeb5d510679701fa0ba997a347999d9fc535f83e38d3914c6", "size": 43842, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e558e3eefb5a2fe5b3ba3aa19ed33f932b3fd77c", "file_type": "created_file", "id": "file_325", "md5_hash": "3a3a2f0cf688051867da1a102a06bf4c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\ppqizb7pszmep.m4a..doc", "sha1_hash": "e558e3eefb5a2fe5b3ba3aa19ed33f932b3fd77c", "sha256_hash": "8b24602303558287d88743d316d682a4638f2f25f6ba91ba7eba107f102b7675", "size": 51360, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e493c273c9500815c8a7cbe630507bc38e30b639", "file_type": "created_file", "id": "file_327", "md5_hash": "0bae79acdbfa8768050dd71671578cd6", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\vm4enrsiqigsp.m4a..doc", "sha1_hash": "e493c273c9500815c8a7cbe630507bc38e30b639", "sha256_hash": "b3aa9d9dfd8b5b072e3b35068e58a2853b4fa93d2c1797b6bc8567ab1344f63b", "size": 69040, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/307327956ec1124c4a945ad175779eb637d7bd58", "file_type": "created_file", "id": "file_329", "md5_hash": "36ec66301c50b899fb4f26e0d6e0096d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\9qybl5jzyjkpk.mp3..doc", "sha1_hash": "307327956ec1124c4a945ad175779eb637d7bd58", "sha256_hash": "6c313dd4858f47d61d0a618aebf65e98c2a06d649ba347f282bce38cbc282f31", "size": 96752, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/07666e5cb6475230aef594bb9c3993a3d0117471", "file_type": "created_file", "id": "file_332", "md5_hash": "fcc60f00f0c916574574f596403c98a2", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\boyhfub.m4a..doc", "sha1_hash": "07666e5cb6475230aef594bb9c3993a3d0117471", "sha256_hash": "387ed2ea2731052e631ef943a0d609ad3b346a1865fe6a877131db0bc91ed1c3", "size": 91962, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cc5a7e3f8c17d2a7dacd3624d82b40ac2f894ac9", "file_type": "created_file", "id": "file_334", "md5_hash": "da1f34ad32348d864a69f3f26fd74705", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\cm_emr.mp3..doc", "sha1_hash": "cc5a7e3f8c17d2a7dacd3624d82b40ac2f894ac9", "sha256_hash": "f145082df5097586bb5dd25e14a361d621d77bd14c4e174c7e5bb8c99aa39f8e", "size": 61871, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/04de33073d4f6bd653be579c0d3a019b28d3296d", "file_type": "created_file", "id": "file_336", "md5_hash": "f68b9e595fa1d2cfe074d3329b315ecd", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\mzvj-71fzcsc6i.m4a..doc", "sha1_hash": "04de33073d4f6bd653be579c0d3a019b28d3296d", "sha256_hash": "3bf2e46f349980e193421664cf4d4accfe28c49e48ef596653ef89fc868b9da6", "size": 25645, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7349f59264588f812d16dc0e2397b085c93f9325", "file_type": "created_file", "id": "file_338", "md5_hash": "14d4489a821158afbfa5116dc33aae69", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\sjwerqq.wav..doc", "sha1_hash": "7349f59264588f812d16dc0e2397b085c93f9325", "sha256_hash": "dfda495f4b70c219bee2b8b857e1c9e64e45908b33cc5fb6d709119151b986c1", "size": 41120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9ee6383f3e92cd745049320943b92e561e6b8d7a", "file_type": "created_file", "id": "file_340", "md5_hash": "c63fb19280568181cd7e597a7a843798", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\tnvqh.wav..doc", "sha1_hash": "9ee6383f3e92cd745049320943b92e561e6b8d7a", "sha256_hash": "cae05315fcc1cdc50661b05daff39e3747ab024a6781abf2243405faf1a100aa", "size": 50736, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a7d6c597f67bedbce0b7d4843a274574e9f14ebe", "file_type": "created_file", "id": "file_342", "md5_hash": "2dd61f65d7d549f0564ae374b7bdc10d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\desktop.ini..doc", "sha1_hash": "a7d6c597f67bedbce0b7d4843a274574e9f14ebe", "sha256_hash": "4a5b08ec17f9054b0cbb823f51431fc0ee45bcd530e1ede13945052efce215af", "size": 1456, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/78a35bb209ef9c18c5ece7ab4a5ad5781af10778", "file_type": "created_file", "id": "file_345", "md5_hash": "3effda9243388de22d1e73b186f14b2f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\desktop.lnk..doc", "sha1_hash": "78a35bb209ef9c18c5ece7ab4a5ad5781af10778", "sha256_hash": "7bec962c747e54009967b6bd6455e40f6829ffa9a22ceccce2ba579de2653e83", "size": 1472, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4ad79b7925cafafd4a800e09153f86bedbfbe8a4", "file_type": "created_file", "id": "file_347", "md5_hash": "e46c1d25aa5c77c12544f777a3ad0719", "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\downloads.lnk..doc", "sha1_hash": "4ad79b7925cafafd4a800e09153f86bedbfbe8a4", "sha256_hash": "453a1c16eb3ae9f01e75204f4b3083732bd08300dc300d82c639ab28d2489c9a", "size": 1920, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/16c74278447505ba6d7f7015a7eb983f813f4c9a", "file_type": "created_file", "id": "file_349", "md5_hash": "ac1a60a4a24598311023a14e20d6bbc2", "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\onedrive.lnk..doc", "sha1_hash": "16c74278447505ba6d7f7015a7eb983f813f4c9a", "sha256_hash": "a19711d62c877ad3ad615a4fb309515593f5bb480949debdf070a8dd1158a4b2", "size": 2000, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/407b56722ef60f05c5edd7297278b223320f836e", "file_type": "created_file", "id": "file_351", "md5_hash": "c502ca9fdbec3f60dc8b4a0f8c82f0c3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\bing.url..doc", "sha1_hash": "407b56722ef60f05c5edd7297278b223320f836e", "sha256_hash": "e3b8f17d1280c97b6e041d95854da3772509c5a9883d7a9f1bcf3acc8bb279c9", "size": 1152, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4997f213a0a8f74565d3d4a6411ee74ed5d370d5", "file_type": "created_file", "id": "file_354", "md5_hash": "8e72f402d6f32a2eb8b40ef2bf09d134", "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\desktop.ini..doc", "sha1_hash": "4997f213a0a8f74565d3d4a6411ee74ed5d370d5", "sha256_hash": "4f7b953408cc9936a382ff90102cbc50db2625cab0d8d017a81caa4b8132ecb5", "size": 1360, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ab6991ca91766ffa6a1c1c85d373eb2ba58b687c", "file_type": "created_file", "id": "file_356", "md5_hash": "e4dd0769eed2ff53c7a6d53383848aec", "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\links\\desktop.ini..doc", "sha1_hash": "ab6991ca91766ffa6a1c1c85d373eb2ba58b687c", "sha256_hash": "72a735d2fd20e5eb2909a8a433c0e3155452df4ea83b7c9dc43775144053c7b5", "size": 1024, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a2efedfc9abdf934a0703583b1e602843e2ad95d", "file_type": "created_file", "id": "file_359", "md5_hash": "d799fa9f1655f95dc9be3bd1830e630c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\chromesetup.exe..doc", "sha1_hash": "a2efedfc9abdf934a0703583b1e602843e2ad95d", "sha256_hash": "a997604d3eba8e39c9f26b46448adcf9ca5ec53fcafb6328a733acaa3f069bf3", "size": 1131272, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c70b3c04a93e561b4cf463ac44d10923da75566f", "file_type": "created_file", "id": "file_362", "md5_hash": "a366561c12c6f69711d3bb85e052fa7d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\desktop.ini..doc", "sha1_hash": "c70b3c04a93e561b4cf463ac44d10923da75566f", "sha256_hash": "b1422698d4c21483ab1bd86344784727cad570b0b0b1eeaef1f221496e685910", "size": 1232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fc15665973703bc952db494bde33bb27c2da45f9", "file_type": "created_file", "id": "file_363", "md5_hash": "74d7fac20609cfe929862a5b95dd43ba", "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\jre-8u131-windows-x64.exe..doc", "sha1_hash": "fc15665973703bc952db494bde33bb27c2da45f9", "sha256_hash": "b5d48def2860405b1a3e1ab188403156baf95856e15ffdbcfd30bd5813cd476c", "size": 10485760, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3e0290cf998e9438a8fdc1d728853baf249855d5", "file_type": "created_file", "id": "file_365", "md5_hash": "8ae6ba7e2cef64e1b83d905ef8a359d1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\5lfe4lx.pptx..doc", "sha1_hash": "3e0290cf998e9438a8fdc1d728853baf249855d5", "sha256_hash": "3319a6208bce5f2ffb77ced09c10b7f946b6ca496ebc1f1ca383d1da45309173", "size": 92133, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fe0682c1a4d8d9f3a4e42ba6b9cbc3d8fc5e3d81", "file_type": "created_file", "id": "file_368", "md5_hash": "bb2b28d3d9425e23ace84a09fac7df48", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\atcbua--7ps9_ex5yf.xlsx..doc", "sha1_hash": "fe0682c1a4d8d9f3a4e42ba6b9cbc3d8fc5e3d81", "sha256_hash": "128d71c93597a29a31d5c6e0b34302de049a6b8946013e5a8eaf11dc0ebd6159", "size": 26440, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/179cf3e5b3ff62e80bfa8e04da3cbbfb36008987", "file_type": "created_file", "id": "file_370", "md5_hash": "e0ca48aa6b416a728272cb8532669d77", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\blbtlle6nvl7pn1.ots..doc", "sha1_hash": "179cf3e5b3ff62e80bfa8e04da3cbbfb36008987", "sha256_hash": "a205e4456ed8fc355a9c921561d0ba86572f7b2a97b437f56d28bb09fdcc1cdd", "size": 59783, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/860a7d33a834d69fcc947226d561d6ca7c1440bb", "file_type": "created_file", "id": "file_372", "md5_hash": "7132d3a594fda47d039273bbc40dbffd", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini..doc", "sha1_hash": "860a7d33a834d69fcc947226d561d6ca7c1440bb", "sha256_hash": "b9b2bd048b7ee2b23a488b39c36a49d1a453087428ae56f7f43624b1658624bc", "size": 1360, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9f7f60ae8a6b76f239c49538aa2861b54decd2e8", "file_type": "created_file", "id": "file_374", "md5_hash": "d6c0aecc35c6752044fc0a3f358c4438", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\em9gxmq2lkv8zfra.docx..doc", "sha1_hash": "9f7f60ae8a6b76f239c49538aa2861b54decd2e8", "sha256_hash": "629221550960a4923ccad59511006ceacc33207ff3ae1ad3a325b5b7491d1a7d", "size": 55424, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/39927f5aa90216eb773e0c6e75e302b758a972b8", "file_type": "created_file", "id": "file_376", "md5_hash": "38829e481348405ceb8c56ea6afafcbc", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ihzco2.pptx..doc", "sha1_hash": "39927f5aa90216eb773e0c6e75e302b758a972b8", "sha256_hash": "adaa6d74ea28423855e6e7692b6e3f8e017d8a8e927b9ac2a1267bf01db3f422", "size": 93272, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/875b442fdc757c1aa6aeb27a313e6fc39057745b", "file_type": "created_file", "id": "file_378", "md5_hash": "bb3004b11d168b4a36362ab8dac001e3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\j0-1vw5m.xlsx..doc", "sha1_hash": "875b442fdc757c1aa6aeb27a313e6fc39057745b", "sha256_hash": "928ba3e229fb49221ffc5776bef2dbeef69868e8e47cbdbd142a06ac1e622b66", "size": 40992, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5adbfab896b3022888b98fc88fba17090f2f3711", "file_type": "created_file", "id": "file_380", "md5_hash": "bdd35099b5733ef0f88a0ef16d548022", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\k3dcza0zgh0l2.pptx..doc", "sha1_hash": "5adbfab896b3022888b98fc88fba17090f2f3711", "sha256_hash": "aa91542cbf44a112c3ca34b229643b425702ac2fd7e393f38673b258ee01b17c", "size": 69696, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e05607a0e937a02d31306827ad5146115f0c08f1", "file_type": "created_file", "id": "file_382", "md5_hash": "f62e0d8e2121eba5a7eba2c4295d5119", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\kfqf_.docx..doc", "sha1_hash": "e05607a0e937a02d31306827ad5146115f0c08f1", "sha256_hash": "18395014b6110b19aa83fd46ebfcb68071f3b217135cce3a1369cb17e980845a", "size": 103120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/06a99fd7f41b10a48adeeab576bdb8f600b3f26c", "file_type": "created_file", "id": "file_384", "md5_hash": "c313df2430b95bccf035b45e8b914d7c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\lmdzhf4zvs-.pps..doc", "sha1_hash": "06a99fd7f41b10a48adeeab576bdb8f600b3f26c", "sha256_hash": "ab9a7e09e71451e51982810687069d152bc87cdf15a878a0f3e2bf715cd22491", "size": 71088, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b0ac972721872d2bdad0d08c5c42987ad6c54d5e", "file_type": "created_file", "id": "file_386", "md5_hash": "271ee1a8f66413cc5cbdc13ee9a38eb3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\m_9esbnarkheuqxe.docx..doc", "sha1_hash": "b0ac972721872d2bdad0d08c5c42987ad6c54d5e", "sha256_hash": "0007103666a7d2d5ad561fe7672a402e3057fdc335683721e9d41cc2c8f4d703", "size": 42297, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/364294d210db5d175c90bccc29115097075c7810", "file_type": "created_file", "id": "file_388", "md5_hash": "4e89acc7705a2c247531cfb38cc959ad", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\n3kedft.pptx..doc", "sha1_hash": "364294d210db5d175c90bccc29115097075c7810", "sha256_hash": "654f3b03bb659e77075ec644c0550db81dfe36b8c5b5dac184ac1aaff79b7468", "size": 48582, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/20e6954a2f3b7b21ccdd95abfba6253d4962ca80", "file_type": "created_file", "id": "file_390", "md5_hash": "43a109cbad2a998a80bb3859c38d63e5", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\oev elnpibhwxetbc4x.doc..doc", "sha1_hash": "20e6954a2f3b7b21ccdd95abfba6253d4962ca80", "sha256_hash": "97831cd49259321394e24360862bef0b4ed701f8f68bf17eaa16311fa28e0046", "size": 23984, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/16b0110bfec3748471ff0a9af02bc1e3feaa945a", "file_type": "created_file", "id": "file_392", "md5_hash": "2adb27e44099ee6d25e57e76a8a47620", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ox bq4vkxjpjqad.xlsx..doc", "sha1_hash": "16b0110bfec3748471ff0a9af02bc1e3feaa945a", "sha256_hash": "7c8c94ea900cb780b1e86f4f4c98123563be7ab7fdcdf3ba44917a1cf7df82e0", "size": 19648, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2125df9acfb366e05b4eac0df7544885b45e2055", "file_type": "created_file", "id": "file_394", "md5_hash": "f4a581445f7aa9a08a908eb3435d3bc1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\t zqsdpu2iujxle-.pptx..doc", "sha1_hash": "2125df9acfb366e05b4eac0df7544885b45e2055", "sha256_hash": "3e65b92de3ec19e33ba27854b4d525590f0783787d100e075a46fd0fe903584c", "size": 11326, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7d84cd164ca658ec1ffa8e0076a05e0d90834840", "file_type": "created_file", "id": "file_396", "md5_hash": "5ed82021669a29cfaff651ff2eb994b7", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\t-k5sgwmj3 mpb9ky.pps..doc", "sha1_hash": "7d84cd164ca658ec1ffa8e0076a05e0d90834840", "sha256_hash": "f399c4c10846ff3acee01c2f1245171d52644c60e3d36288fb23c194a4290c56", "size": 29587, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2f34d66c058d9695961bdff0b84bbe82f08a04d1", "file_type": "created_file", "id": "file_398", "md5_hash": "c5f37bb31bf82d434c4f160447302c2f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\utm7gxl.docx..doc", "sha1_hash": "2f34d66c058d9695961bdff0b84bbe82f08a04d1", "sha256_hash": "73f5a5be792c8bc6482290898c5650bb8b919d016a0d77c1fb8825e6a179805f", "size": 3200, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c13664a4c2005697da822c62e112cbdf606be53c", "file_type": "created_file", "id": "file_400", "md5_hash": "0aadbe0252995e204ad2923b0f16f804", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\uwnmvsu.xlsx..doc", "sha1_hash": "c13664a4c2005697da822c62e112cbdf606be53c", "sha256_hash": "c255a6b0b9b59d2ee5ba0049086a146cbb803feaa1ebb19c0da0c4d768d3e355", "size": 43452, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b3504351bcf95644560fb6e085fe6daec668d7af", "file_type": "created_file", "id": "file_402", "md5_hash": "3cde757e4ac9b478f2008278635e5fa0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\v5i14i.docx..doc", "sha1_hash": "b3504351bcf95644560fb6e085fe6daec668d7af", "sha256_hash": "9e3dbf4855f172b589e18a4199a4453238f4ca2a24e57c2ea3259b8eb5c3dc43", "size": 88704, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/801fdc717f4d616a34639ed2c53c6304313d39ce", "file_type": "created_file", "id": "file_404", "md5_hash": "6238bb78be1339b9b84d1d7269bc154e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\vcavi.xlsx..doc", "sha1_hash": "801fdc717f4d616a34639ed2c53c6304313d39ce", "sha256_hash": "5f57480f45195ff6f9b47fe359af826bbf874a773dc501c9680dea69016e1f3a", "size": 31395, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4bfe1825d7b1d75e7cdc9806eabd5e4b392b72ac", "file_type": "created_file", "id": "file_406", "md5_hash": "0bde91f0221a2b4ad9a3b70bde3b8210", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\xci5tni.rtf..doc", "sha1_hash": "4bfe1825d7b1d75e7cdc9806eabd5e4b392b72ac", "sha256_hash": "007070b5fc331849f1bd6e0a7db59103032bcd88b605469deaeb78da74cadc04", "size": 56576, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e0a22e6515fff108263aec290c8f0c0eca772fdb", "file_type": "created_file", "id": "file_408", "md5_hash": "fef54df67c6fdf75b7060d5f49e2b8d3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\zyrasy.xlsx..doc", "sha1_hash": "e0a22e6515fff108263aec290c8f0c0eca772fdb", "sha256_hash": "29843e2e80655534d29fb410f4a68e457e872d90f7b0ecb57869cb4581a3b89a", "size": 77830, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da0d71891879f9d1119585929f6a3e70d89cf327", "file_type": "created_file", "id": "file_410", "md5_hash": "c9a73b53db9df683fd0ccddd73677e5c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\1oyb.pptx..doc", "sha1_hash": "da0d71891879f9d1119585929f6a3e70d89cf327", "sha256_hash": "989136495493a8503b90b7bcabc84485d3bf28223aa3cbb0d8b21a124af376c2", "size": 73536, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f15fa83391c035ed7147af2d644933297b423dba", "file_type": "created_file", "id": "file_413", "md5_hash": "80a43a0cd95e74917ab9b95c595aa51d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\5fs 9 uvpa.doc..doc", "sha1_hash": "f15fa83391c035ed7147af2d644933297b423dba", "sha256_hash": "898e7ae080088de473abc7489ae11cbd154c1ab65299c331e5053cd0bbbfeb06", "size": 23552, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/768dd32ba36737944d5ace6bfb5af83707c56eab", "file_type": "created_file", "id": "file_415", "md5_hash": "eddf88a74f8c1e38e81b2d39d0fb7287", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\l1ep-e2o7byfuic0.csv..doc", "sha1_hash": "768dd32ba36737944d5ace6bfb5af83707c56eab", "sha256_hash": "40898d186753f8d7e6023c96570a22e1444f1a124f762f4c07ca2aa64b928e99", "size": 43516, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/585383376b2364edc3995107f438512f3884efca", "file_type": "created_file", "id": "file_417", "md5_hash": "05a2747411805d61007a585241022ba1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\qf 8oxk89nl1yrk6.rtf..doc", "sha1_hash": "585383376b2364edc3995107f438512f3884efca", "sha256_hash": "6c3129a81a26f0d276a764ed3c7fbaace8ce847eded077b8516803c60e66052f", "size": 90304, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/00704182211c992a1248d141d56478cafa7132ff", "file_type": "created_file", "id": "file_419", "md5_hash": "ed686da5f988824371258451d3ddb018", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\18wqha51.odp..doc", "sha1_hash": "00704182211c992a1248d141d56478cafa7132ff", "sha256_hash": "019368379f17cc4936c49d82ce42e559cd289d8c6510f3da1543e20244290801", "size": 33442, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6b9c157cb058922272eb22c3c5602c1d94785b56", "file_type": "created_file", "id": "file_422", "md5_hash": "c44fb790a903e179e9e7e99ab84bc1e8", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\d91n0zq.odp..doc", "sha1_hash": "6b9c157cb058922272eb22c3c5602c1d94785b56", "sha256_hash": "aea9d1b73f8f83a8f2bb9c909c6033078ec0b5c189622f19df8d03ae341538e5", "size": 75325, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8a6973f5df8e4150a945138e774d8d12fbfc681f", "file_type": "created_file", "id": "file_424", "md5_hash": "b2f5778eaa82936b9880b13b6cc13da3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\snyjwdmydf6ncuaoqltl.xls..doc", "sha1_hash": "8a6973f5df8e4150a945138e774d8d12fbfc681f", "sha256_hash": "c733222b99882a60e133f39aef7cbef6374e93533ad12ef791f6dc558db83185", "size": 7120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/21907f66018c1e00fbdeae8dbbbe08e8312e1128", "file_type": "created_file", "id": "file_426", "md5_hash": "45eaac4bc88b05e200b38b08360ac8fa", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\wryiecxnl.ods..doc", "sha1_hash": "21907f66018c1e00fbdeae8dbbbe08e8312e1128", "sha256_hash": "7e32f2864e64a33eb337e4bca656e4b81d6115d7e3984cf1cf70a78cb007c786", "size": 42698, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/35aeab669ec14f35f86cc273f380a4b618822039", "file_type": "created_file", "id": "file_428", "md5_hash": "a099b07894d23f259de01bcd81532ab3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\xctuw.xlsx..doc", "sha1_hash": "35aeab669ec14f35f86cc273f380a4b618822039", "sha256_hash": "a638b3b671899fc0c2a422c3f662045bdaaf1269138b1b16ffe4dad39a6eba8a", "size": 53248, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/72322e6a97eca15e148203c98b50e7d095a37f12", "file_type": "created_file", "id": "file_430", "md5_hash": "ce5622667042406ce58a90565531f08b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\xie6iniolr04edgffg.odp..doc", "sha1_hash": "72322e6a97eca15e148203c98b50e7d095a37f12", "sha256_hash": "60d63174500f7fab9f0922dc5f2a82091e05ee312f4d75e5aabffa5ad2640f80", "size": 83584, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2cce857577dcaa1d2fdae120468c3eb588ebd3c8", "file_type": "created_file", "id": "file_432", "md5_hash": "5139f918139be5599211e4c712f07bdd", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\kfmszdl4nvsi2cz.docx..doc", "sha1_hash": "2cce857577dcaa1d2fdae120468c3eb588ebd3c8", "sha256_hash": "5b4d1b02dae55d427fd7ecd2cb5df99d767fe36058c6b567e33994088a3ef535", "size": 70096, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4c3768d54fb47063f1c1755c70088160d0e244d9", "file_type": "created_file", "id": "file_435", "md5_hash": "326f7cbebd98a3b18f99a43a7db7b05a", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\wgy2yqxdku.pdf..doc", "sha1_hash": "4c3768d54fb47063f1c1755c70088160d0e244d9", "sha256_hash": "7f71b00cb45357d55d27f6d2b94aebfdfce3f35dee287a8adcddb17c5ffa02b8", "size": 34704, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9f4a43f439980be525e48c9fbff55fc7edabc093", "file_type": "created_file", "id": "file_437", "md5_hash": "d5997333bcd42432169bfcaee29512f0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\wi8f0q5o.xls..doc", "sha1_hash": "9f4a43f439980be525e48c9fbff55fc7edabc093", "sha256_hash": "bb2fe0b0822c2002b2ce57819b375c0f52cd68d7979d002272f227af7ae8b6dd", "size": 8640, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5b29d9da543911b9f24bd5d241b1d8c9a9bd80fa", "file_type": "created_file", "id": "file_439", "md5_hash": "9de86a69a5cc92864320d842ac329aaf", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\x5iffemyr.odp..doc", "sha1_hash": "5b29d9da543911b9f24bd5d241b1d8c9a9bd80fa", "sha256_hash": "ef0c4f7b3790b7af48fb54d9c088e8ad78ffff7a37de5d6deb49ec19b589016a", "size": 28543, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1df958b17a5b9763fb698187cafec716ab9b1d79", "file_type": "created_file", "id": "file_441", "md5_hash": "128767fe14a9907085fd57f6c937cfc0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\xy sr4g.pptx..doc", "sha1_hash": "1df958b17a5b9763fb698187cafec716ab9b1d79", "sha256_hash": "134129fe83705338601df589940d84ae9218a1a75fc2d0c578408ae9748acf64", "size": 86848, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/92ca8270f596b9429482882370e3c4253fe257eb", "file_type": "created_file", "id": "file_443", "md5_hash": "b2749671c660f1646c5037ec51a8bf90", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\yb mn0zdv.pptx..doc", "sha1_hash": "92ca8270f596b9429482882370e3c4253fe257eb", "sha256_hash": "7e14be90109155ea24e755540485f426e893954710baf6285b5eef9e63d992aa", "size": 96185, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c1fb7eafa9413c5aa69d844b7892796f8dd0b842", "file_type": "created_file", "id": "file_445", "md5_hash": "d53936a9eec3f561e3ebfa9c778c4334", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\5walp3bl2rwl-yo.xls..doc", "sha1_hash": "c1fb7eafa9413c5aa69d844b7892796f8dd0b842", "sha256_hash": "3bf122ad6abeb26c19b9333ce3411ba51ef96d24d141e8128a338de4056f0377", "size": 85888, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/40ba7d618b16398d69675848db8f3c9e374096d8", "file_type": "created_file", "id": "file_448", "md5_hash": "955e310b305a7e8202364c651d7e75b8", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\oidz6lcgnvxgf5.csv..doc", "sha1_hash": "40ba7d618b16398d69675848db8f3c9e374096d8", "sha256_hash": "e2a8916d0118c0fd8d54cedd715ab3af840515aad7a60473574cde18de86d475", "size": 42211, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1a6c72464834014a881501cd2dbc1f20e346a240", "file_type": "created_file", "id": "file_450", "md5_hash": "3e51be8ba7c141dd85be275ce5cccbc3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\opt7hcn-3pa.xls..doc", "sha1_hash": "1a6c72464834014a881501cd2dbc1f20e346a240", "sha256_hash": "13ffcb9e9f4301353a8f50af6bf4af1778c1a07562de78044a4cc394802c10e5", "size": 24288, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4d59939d7abe3f0b9accde8a972a1dd8f7f9aa0e", "file_type": "created_file", "id": "file_452", "md5_hash": "aeb0d0c152fd93185711103144ab979e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\psmh09ma0h6sf.ots..doc", "sha1_hash": "4d59939d7abe3f0b9accde8a972a1dd8f7f9aa0e", "sha256_hash": "8a2ecaea0995acdefa73abf55121aa89cd6fde12362cda4928e57169714ec8fe", "size": 44093, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f232156e9c35549d716910003fb608ba57e44ed2", "file_type": "created_file", "id": "file_454", "md5_hash": "41d2932154f84eaf3cab87bf7a31cfcb", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\st0nfhr7kld7u.doc..doc", "sha1_hash": "f232156e9c35549d716910003fb608ba57e44ed2", "sha256_hash": "ccb1380350d1cf11b606f4fad048837386749aec598121b9710c4c3b2840568f", "size": 2576, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/62a2d45b559f9b7a60926a8a99f5633e12c48081", "file_type": "created_file", "id": "file_456", "md5_hash": "f32acbff1d55d75ff859ac340b6514be", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\ud56yevtc_mgvyoy1e.pptx..doc", "sha1_hash": "62a2d45b559f9b7a60926a8a99f5633e12c48081", "sha256_hash": "a5cac3c6ff0c64690a3b2239090494e30083a5b42f838f22f8390f38e6727e2b", "size": 26845, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6d0056a644b354efae9424f01dab3fa33355f9ab", "file_type": "created_file", "id": "file_458", "md5_hash": "55c6a2205364cf393b393ce3fe80297c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\vatb.csv..doc", "sha1_hash": "6d0056a644b354efae9424f01dab3fa33355f9ab", "sha256_hash": "1e53ab22d9ffb9afb5d3fc4935107c830caf2129bd7141be820c982e2e09ad8d", "size": 15953, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/40d49f0e6ae4a03c3e8f31d5505cf786932996a8", "file_type": "created_file", "id": "file_460", "md5_hash": "e4ca725480de99538747656fb243f6a0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\yfdwehymeqvc.rtf..doc", "sha1_hash": "40d49f0e6ae4a03c3e8f31d5505cf786932996a8", "sha256_hash": "68e7cd45719d00a84ec4845337ab3f9fcfcec5386664c0d2426d907061bb53ca", "size": 46066, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/54c390f584ef73b4f678bee834c8ccea0bb1dbea", "file_type": "created_file", "id": "file_462", "md5_hash": "ed3f754e5eca0ffa477f9b6e2ed592f9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\wcamw\\3qzjcog3a.ods..doc", "sha1_hash": "54c390f584ef73b4f678bee834c8ccea0bb1dbea", "sha256_hash": "799f2ab2e477efd4b00f4a8c932f2f3d7ef50c86ed5a5f7a5750f3c5ad9d1b2c", "size": 18624, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2510608c7e28d38e78465b8c4a48d886b2ae3482", "file_type": "created_file", "id": "file_465", "md5_hash": "c0ccae55766c814555f970daad435d74", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\wcamw\\hfvups2ina_-bdqv8.rtf..doc", "sha1_hash": "2510608c7e28d38e78465b8c4a48d886b2ae3482", "sha256_hash": "e2ba19b9bb407881b43899599adb1368bae5d8f7f748fc95c14196731a0bde1d", "size": 87824, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5790d282e5fd089b445970b5715e31f15667ad03", "file_type": "created_file", "id": "file_467", "md5_hash": "1e22fc77e5bc9612f67bf185dfc04a15", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst..doc", "sha1_hash": "5790d282e5fd089b445970b5715e31f15667ad03", "sha256_hash": "05179a8e28d115d9421190660a0216a83e68ea9f1c07cade8af59e39d4194a65", "size": 272304, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7f9ead291dd9cb8ee524c82c4e30c3ae15d829b7", "file_type": "created_file", "id": "file_470", "md5_hash": "9aa8a9f23804a3ec80fa871475dbfbdb", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2..doc", "sha1_hash": "7f9ead291dd9cb8ee524c82c4e30c3ae15d829b7", "sha256_hash": "77b4c0d5077e25a7a3704e7f90b30af7bc246962689b4730457875e3ddcd0973", "size": 7136, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d7617d18bc4c5dfc5e3aa2e8d8261bbe0d756134", "file_type": "created_file", "id": "file_473", "md5_hash": "a41e1e20c8bde5fea292e8b65d41986f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one..doc", "sha1_hash": "d7617d18bc4c5dfc5e3aa2e8d8261bbe0d756134", "sha256_hash": "5c7795ed04090e95cd8e455955db8738e4a2124bbc17544de863e0899051698d", "size": 361080, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f8efb0bfbdbc55f85ac8c41a76888c1ffcb833c7", "file_type": "created_file", "id": "file_475", "md5_hash": "b7ba30f52e6052a678f9b39e7f965d17", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\desktop.ini..doc", "sha1_hash": "f8efb0bfbdbc55f85ac8c41a76888c1ffcb833c7", "sha256_hash": "4fb0d86f57dc9ce54ad774b2f8d42292f226f3af462a56b2a8ad6bb0dd670c53", "size": 1168, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5cfba21a4bc52a1fc56b8ce92cd554861da3aaa1", "file_type": "created_file", "id": "file_479", "md5_hash": "41c4d389a921cbb64521e10a5078c10c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico..doc", "sha1_hash": "5cfba21a4bc52a1fc56b8ce92cd554861da3aaa1", "sha256_hash": "1a8c01876d88f34dbbe6d6594057c12893ef188f4cc1066f17876d3096639495", "size": 30870, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8326e7835c750b9f5db47e5d2a22f2b050e8a85b", "file_type": "created_file", "id": "file_482", "md5_hash": "1b0174959cdf1c95e7302f7f642aab37", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\grki.docx..doc", "sha1_hash": "8326e7835c750b9f5db47e5d2a22f2b050e8a85b", "sha256_hash": "62aae11d86e50f8dbcaf9093247519aa18272dafdadefc36b8d3d505bf7e27d8", "size": 53552, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/443ce008650116e5f5b2e46405f9012112a7d464", "file_type": "created_file", "id": "file_485", "md5_hash": "85052940c01ef0d3c9c27f50d59a6baa", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\kt33n_.ppt..doc", "sha1_hash": "443ce008650116e5f5b2e46405f9012112a7d464", "sha256_hash": "0d9ccdc0d2312b2fdd4acd1ab28f1d539aa6a799eb470984fb4c494d62fae004", "size": 10980, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bb17fdf10902f89c0e50402243b81c5725f9f202", "file_type": "created_file", "id": "file_487", "md5_hash": "e0ad9b054b207ded2770a5b538452a0f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\ucq2jjz35.xlsx..doc", "sha1_hash": "bb17fdf10902f89c0e50402243b81c5725f9f202", "sha256_hash": "67199ddf4dbd100f8a710b2ca6a95eb7fbca95e9bdbc37a8431bf3e34d71b3d3", "size": 86384, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1c0d13aac0f75b3bb076003af17e3d0d056bf25c", "file_type": "created_file", "id": "file_489", "md5_hash": "4eaad822e259b13761f077f604889d85", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\vvbl5czqczhto.pptx..doc", "sha1_hash": "1c0d13aac0f75b3bb076003af17e3d0d056bf25c", "sha256_hash": "d2a6a09d8be9a40d4256ef12a37ffe01f5979ab403d6464058a38a4388e371be", "size": 51856, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7152dfea0d70b3bc0aae98d0117878b3bfb4e189", "file_type": "created_file", "id": "file_491", "md5_hash": "1696b50b454109c22f7c62c0714fbb92", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\1ilkjyrgg.ots..doc", "sha1_hash": "7152dfea0d70b3bc0aae98d0117878b3bfb4e189", "sha256_hash": "a762cb70e2691cca2658d174de64f6c2188bc17fe2a3fe7e1e989606aa5b17d5", "size": 47702, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3625354724d3a06c839371ed15d5f8af54be7078", "file_type": "created_file", "id": "file_494", "md5_hash": "1049d6cfe5fcc37f7e557a255cec377d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\23i5acjuyspml.m4a..doc", "sha1_hash": "3625354724d3a06c839371ed15d5f8af54be7078", "sha256_hash": "790f1d58144a7dc5b4d191b921fcee9bc029dfaf79a368f6fcd7e3950982414d", "size": 80678, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/39d8ad9b912c520658a91b194d6ce7ccaf7b937c", "file_type": "created_file", "id": "file_496", "md5_hash": "1a8c1766f2707c2f0973a80b3531f419", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\34vihcjptwsy126cu6r.jpg..doc", "sha1_hash": "39d8ad9b912c520658a91b194d6ce7ccaf7b937c", "sha256_hash": "05b299956ca9ed1ccad20469151cde9c1e811cdaef4d01ac71f8e0fc830e885a", "size": 84496, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8422a1e0d87c962ea7138611920d7218bb68e29a", "file_type": "created_file", "id": "file_498", "md5_hash": "0aadc6941fef5e387cee1db92622d22e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\5aymmplf.mp3..doc", "sha1_hash": "8422a1e0d87c962ea7138611920d7218bb68e29a", "sha256_hash": "9e6a6d4489b2489ff45ac6c29993382955159ed43c4ebf69f5fc00632376c183", "size": 75615, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/010b5042c14e40944d38329a95fe24793bbe3989", "file_type": "created_file", "id": "file_500", "md5_hash": "28ba4169da6d69a97930ba2edd8c6ef2", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\7uelr6 ahnxhpqmpu.flv..doc", "sha1_hash": "010b5042c14e40944d38329a95fe24793bbe3989", "sha256_hash": "29fc657349085667f690d1aa6b761fe060ff1765abc96f66f9e6e65bab12b1e1", "size": 9750, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/18dec2ee645b8558ff53f9a56a80d60b06d62fb2", "file_type": "created_file", "id": "file_502", "md5_hash": "0a88f39f142d19070c62bb3853c9fb88", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\9j9hsv0agjq5p.mp4..doc", "sha1_hash": "18dec2ee645b8558ff53f9a56a80d60b06d62fb2", "sha256_hash": "dd478094357324673e879840eb21a008ee218b69107c7c097d4621f4a96e5506", "size": 96403, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bbcf9e81f3a1ab303224edd160f1fe05682cbeb5", "file_type": "created_file", "id": "file_504", "md5_hash": "263e21ad09c330f8518cc491c7000f95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\af0cjnijiae7zpu.swf..doc", "sha1_hash": "bbcf9e81f3a1ab303224edd160f1fe05682cbeb5", "sha256_hash": "d7426fd57e5734570dd1a6b424bdb25827ac84f0fe8376784a6ff877a90a13d6", "size": 3920, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5edba77834febc437f81c74a3d27ad01633153be", "file_type": "created_file", "id": "file_506", "md5_hash": "7413754f9c6e16e9dfc044f6de3b6823", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\bwjej4q.gif..doc", "sha1_hash": "5edba77834febc437f81c74a3d27ad01633153be", "sha256_hash": "ffc5b02b3b793cb97fa3ed455c0faf5829231dc62b3a284055ad53544ee19868", "size": 7168, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0b8d12fcd3c43aed1253a41eb901d2ae794be112", "file_type": "created_file", "id": "file_508", "md5_hash": "bb7a682d9063e54fbc7c03db7a99ff4f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cfrs5lie-afnl_qf.jpg..doc", "sha1_hash": "0b8d12fcd3c43aed1253a41eb901d2ae794be112", "sha256_hash": "c4805b3ab365557436f3cafafe18685652e5849cd7f4f18a145f84b42d894087", "size": 14686, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ced769de411494a779b2b2343cd9f4b79680e3a9", "file_type": "created_file", "id": "file_510", "md5_hash": "5cfbabe8dde1f2fd154410b802dd7b34", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cp_i6vwpeagucdb9vyn0.pdf..doc", "sha1_hash": "ced769de411494a779b2b2343cd9f4b79680e3a9", "sha256_hash": "93999ffd16aafbc136d3e430b5bec7fc0a67f521b0bd5ae4ef00e6317d28f56e", "size": 63704, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/06e8d8c2ffba635b70c747c95c456e3cadf25f62", "file_type": "created_file", "id": "file_512", "md5_hash": "353e22f480804d868ba20aa5ac199d8b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cr1v23mrj a0x.m4a..doc", "sha1_hash": "06e8d8c2ffba635b70c747c95c456e3cadf25f62", "sha256_hash": "667d72304a80383477cc66d3cd1415043e689a10be09a88a652e2ab78b14f6c2", "size": 2256, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/af7733df345ddf40bce6ff8799b0ebbfd06c2e62", "file_type": "created_file", "id": "file_514", "md5_hash": "1303831f18dffd4cf7f31ee7c7682dc9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini..doc", "sha1_hash": "af7733df345ddf40bce6ff8799b0ebbfd06c2e62", "sha256_hash": "032970cd060cdf8c701de88534b813f7b69277ce8ae5be1f12f8363b387bcfe7", "size": 1232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7cda05877b6effc0ea603a0925322fde261c51bf", "file_type": "modified_file", "id": "file_11", "md5_hash": "dd4c03d383fa84a8ccba73e0b34a26ca", "norm_filename": "c:\\bootnxt", "sha1_hash": "7cda05877b6effc0ea603a0925322fde261c51bf", "sha256_hash": "2f1a8b66d168474c99923af0795a35c2cfe9386f64b8000fa24c6fa3402f8a90", "size": 960, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e19f9661239c4fc761385ea3f39b00c9c2c35cba", "file_type": "modified_file", "id": "file_14", "md5_hash": "351a1e2354f9c0ccd36e00b75bb50a18", "norm_filename": "c:\\bootsect.bak", "sha1_hash": "e19f9661239c4fc761385ea3f39b00c9c2c35cba", "sha256_hash": "6f8e024373a23c013124ae16c0e7b38f583e44a252860f4c8380de99a38a9904", "size": 9136, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8b6bf3c2e93724a603abc372e772fd4c8a1a154b", "file_type": "modified_file", "id": "file_16", "md5_hash": "03fa1e0ea94f96e88df614abbe0703b1", "norm_filename": "c:\\users\\desktop.ini", "sha1_hash": "8b6bf3c2e93724a603abc372e772fd4c8a1a154b", "sha256_hash": "237e277cf6439d70c327f263cb443e4b9f23e1736ec5e38d7e9c5a7490626473", "size": 1120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/12b9d3fd9c7b25af9f6030245a9bc7b9a306cc6c", "file_type": "modified_file", "id": "file_19", "md5_hash": "4557a99c5f04dd51e1c57f88eecabfd0", "norm_filename": "c:\\users\\public\\desktop.ini", "sha1_hash": "12b9d3fd9c7b25af9f6030245a9bc7b9a306cc6c", "sha256_hash": "87d3ef818691192276efef80fb2d80a1c3f14d4313fe59566429b9a45a62aa82", "size": 1120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/80e00a9c04a8cb36846da3917dcd095811cd586f", "file_type": "modified_file", "id": "file_22", "md5_hash": "912937c3c9a69c32211d4162d9199fbc", "norm_filename": "c:\\users\\public\\videos\\desktop.ini", "sha1_hash": "80e00a9c04a8cb36846da3917dcd095811cd586f", "sha256_hash": "d2f030314ae9d645cb32763ac0b66125eb38d718a64fddc090376eeb540e07a9", "size": 1328, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a98610896d90d8323dc68135e79b714f585619b3", "file_type": "modified_file", "id": "file_25", "md5_hash": "84033410a1053c63dedc29d312a02fff", "norm_filename": "c:\\users\\public\\pictures\\desktop.ini", "sha1_hash": "a98610896d90d8323dc68135e79b714f585619b3", "sha256_hash": "120db3e5232d5ac034a29d84bbc28e14b7fd08333b515574643d086152052dbd", "size": 1328, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3bc9092919086b28b62ee2e0ce7096b7e43a9934", "file_type": "modified_file", "id": "file_28", "md5_hash": "19df54bac0c5e64d04110ed7d79e8a14", "norm_filename": "c:\\users\\public\\music\\desktop.ini", "sha1_hash": "3bc9092919086b28b62ee2e0ce7096b7e43a9934", "sha256_hash": "e7b4f0156e9e228454ba99d32e680487e680c7c7996cf48709ab54a2f42feb38", "size": 1328, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/aa46c370e3f5d5119f63168eef8c897f1947eece", "file_type": "modified_file", "id": "file_31", "md5_hash": "14f972c6f596015135491f8d195c6999", "norm_filename": "c:\\users\\public\\libraries\\desktop.ini", "sha1_hash": "aa46c370e3f5d5119f63168eef8c897f1947eece", "sha256_hash": "7d0f57e87e3fe8795d13be2e4f2cf9d4a2c15afab4aa58929dbd517077ae520e", "size": 1120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e846d09023adbf67887ee86e8a01b32f826d94ac", "file_type": "modified_file", "id": "file_34", "md5_hash": "e36f7f7f6dc87e0af8a6b625daa9899a", "norm_filename": "c:\\users\\public\\libraries\\recordedtv.library-ms", "sha1_hash": "e846d09023adbf67887ee86e8a01b32f826d94ac", "sha256_hash": "48ae42aa9a9bd8731f6d7b5cac820121c4adacb024ba9e772d6738b0928b61d8", "size": 1952, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2154f40bf4c4189c8d3e963b05c853e4f2df3b12", "file_type": "modified_file", "id": "file_36", "md5_hash": "334326f2445576654b881ca75881a12a", "norm_filename": "c:\\users\\public\\downloads\\desktop.ini", "sha1_hash": "2154f40bf4c4189c8d3e963b05c853e4f2df3b12", "sha256_hash": "70b9f46cd1678b6200e585463d78b91d07ae8ca9f254590fe1d5ce152f6f770a", "size": 1120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6781d39960831bab710c05f590166323646eb7da", "file_type": "modified_file", "id": "file_39", "md5_hash": "fb9580698701e27432647edd2d7eaac7", "norm_filename": "c:\\users\\public\\documents\\desktop.ini", "sha1_hash": "6781d39960831bab710c05f590166323646eb7da", "sha256_hash": "acce99a2039dd0fe6a4256f06e4ef93d4585828d8394bbb4aa8a4eca014888bc", "size": 1232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d36545d6fd09f7c2b574b68e120250347715a28d", "file_type": "modified_file", "id": "file_42", "md5_hash": "8fdc81b4323f97687e071a50b5267496", "norm_filename": "c:\\users\\public\\desktop\\acrobat reader dc.lnk", "sha1_hash": "d36545d6fd09f7c2b574b68e120250347715a28d", "sha256_hash": "ee9058e027d4eb75fc3f979f72db86413401287e4aa18d33e073aed1b1e8547d", "size": 3088, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c685c2f13bbdc51b92da09c4382477e0aeec75af", "file_type": "modified_file", "id": "file_45", "md5_hash": "9dcef2ab01e7b4f41c0de6a3df60f5b4", "norm_filename": "c:\\users\\public\\desktop\\desktop.ini", "sha1_hash": "c685c2f13bbdc51b92da09c4382477e0aeec75af", "sha256_hash": "f3f0ac0332a1aadae365c1b4afca95d14e4fb89d56a47ba7582ca72d40aa1cb9", "size": 1120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9b30a2145e9be12747754935fc14661731c1e125", "file_type": "modified_file", "id": "file_47", "md5_hash": "5e48a236139104b9b82eeb16cb72e0ae", "norm_filename": "c:\\users\\public\\desktop\\google chrome.lnk", "sha1_hash": "9b30a2145e9be12747754935fc14661731c1e125", "sha256_hash": "19d7b1b55ce79827f37860f46180bddaaaf35dd465eb4daf3098638999ab4ab7", "size": 3296, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0d82d70473b3bcd4d3b1f525f6d86f4e1795dce8", "file_type": "modified_file", "id": "file_49", "md5_hash": "ae617e94bd982a4ea563ede72ecdae37", "norm_filename": "c:\\users\\public\\desktop\\mozilla firefox.lnk", "sha1_hash": "0d82d70473b3bcd4d3b1f525f6d86f4e1795dce8", "sha256_hash": "49d51bb8135ae652b9a764971120d484158e06f18efabf29543cd0d6676e57e8", "size": 2176, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5d2c35f8ad96ecda5cebb27ea0f8885656c1038e", "file_type": "modified_file", "id": "file_51", "md5_hash": "efa39eb41053ff0a991c991975875bc0", "norm_filename": "c:\\users\\public\\accountpictures\\desktop.ini", "sha1_hash": "5d2c35f8ad96ecda5cebb27ea0f8885656c1038e", "sha256_hash": "5c4d71bd487cd675b674e5774c8cf24bdf86a8dd5204ec75693ea5960d20e216", "size": 1152, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0ab64335840bacbf8cfcf5deaad8cd0ee9f853ff", "file_type": "modified_file", "id": "file_54", "md5_hash": "d83dcac774dee521012189dc88cc3662", "norm_filename": "c:\\users\\default\\ntuser.dat", "sha1_hash": "0ab64335840bacbf8cfcf5deaad8cd0ee9f853ff", "sha256_hash": "5dfdb0284b4c5a586857ba6ddf5ac921171130b346bca2ff034c47b7d3a68d47", "size": 263088, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/de37ccf141aa88e2b36823c7f264dad2ef879d13", "file_type": "modified_file", "id": "file_57", "md5_hash": "9b22fc5462ac88989eac80428326c8b4", "norm_filename": "c:\\users\\default\\ntuser.dat.log1", "sha1_hash": "de37ccf141aa88e2b36823c7f264dad2ef879d13", "sha256_hash": "0bde45128964856c98d7e041a6f984193f5e2fef9f6e2bae2fece8b8f4dda676", "size": 25520, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d8088abab0fa629c0a2ebd85b09495d004a55eef", "file_type": "modified_file", "id": "file_59", "md5_hash": "0e555c1eade9bd288351ec55ece64351", "norm_filename": "c:\\users\\default\\ntuser.dat.log2", "sha1_hash": "d8088abab0fa629c0a2ebd85b09495d004a55eef", "sha256_hash": "13e5d77a28442e6a35c101086e296861f4ea614b314da9d0fa7a9e098a8c7afc", "size": 517040, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/014d993b9c714e98da5f6c99cd385ec74353784c", "file_type": "modified_file", "id": "file_61", "md5_hash": "57f5d78a1ec92fde51f041dc00d88054", "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tm.blf", "sha1_hash": "014d993b9c714e98da5f6c99cd385ec74353784c", "sha256_hash": "79d7a87a7868d9fa9c931d396517e6cdcd3f7c6dc3c6ba5110693181eb03fc7d", "size": 66480, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9ec639610f86974fa0f04d099995ab77e3123dd3", "file_type": "modified_file", "id": "file_63", "md5_hash": "48edec9d8fe3890abc8a341cf0a24a3a", "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tmcontainer00000000000000000001.regtrans-ms", "sha1_hash": "9ec639610f86974fa0f04d099995ab77e3123dd3", "sha256_hash": "2fa43cfae372a2f004aaee09c314d1641c334862115636da0aa35f5ede3c907c", "size": 525232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/dee459ee5a30f2ff682188a4d33e1c7ef200774b", "file_type": "modified_file", "id": "file_65", "md5_hash": "57b2afe19de2c0e01e104353ce5c97c6", "norm_filename": "c:\\users\\default\\ntuser.dat{77a2c7ed-26f0-11e5-80da-e41d2d741090}.tmcontainer00000000000000000002.regtrans-ms", "sha1_hash": "dee459ee5a30f2ff682188a4d33e1c7ef200774b", "sha256_hash": "07ea3cf325f425abf86e54b86ec9924ea3c9d1cdc9f3abe1d0d4e4314d7212af", "size": 525232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/234adc81a95746aebf2e5f06f6fc63b13d3b814c", "file_type": "modified_file", "id": "file_67", "md5_hash": "1524c23e29ca650fee428d62e876b108", "norm_filename": "c:\\users\\ciihmnxmn6ps\\ntuser.ini", "sha1_hash": "234adc81a95746aebf2e5f06f6fc63b13d3b814c", "sha256_hash": "a9a2ad3c5c92a5dc415de2e8578ca9d214a958f7b46d8dcd988d4503cf9e546b", "size": 976, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5a860bd27a305d6e6af9b8d406836bcdbd0c3d46", "file_type": "modified_file", "id": "file_70", "md5_hash": "bd3d4d5eb25d64e78a8dc21a5b0ce4c8", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini", "sha1_hash": "5a860bd27a305d6e6af9b8d406836bcdbd0c3d46", "sha256_hash": "874beff6a5c1aa61d7c49a25dc23a22eb7b0aecf5cb5b45b455afb0f9d8b52f9", "size": 1456, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2f73ba8ed8f14895d10cd2ecdaebe16029c30df9", "file_type": "modified_file", "id": "file_73", "md5_hash": "a6d96e199780925d81c91bb4fa149841", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\e2wasdx2n_.flv", "sha1_hash": "2f73ba8ed8f14895d10cd2ecdaebe16029c30df9", "sha256_hash": "2f0627608232265a780eae15074fba5f7be01b0a4c5e41c0446e1d75fe69d9c8", "size": 19616, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6887e6ae6c26e10ef141116a800aaeb571cf40e6", "file_type": "modified_file", "id": "file_75", "md5_hash": "869d0badcf60e04ecc2b218ed188b179", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\ibtwm8.mp4", "sha1_hash": "6887e6ae6c26e10ef141116a800aaeb571cf40e6", "sha256_hash": "172284c36a0ac87fb5c30ff25ae5f18efee95ac312fe773b22785c795ff3645b", "size": 63250, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/162bba83fbbfe53f338d365cb2b95e54cdf9bd5c", "file_type": "modified_file", "id": "file_77", "md5_hash": "c0d2b4ce573c4b64c6677f6bc37c7415", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\ny17g87un.mkv", "sha1_hash": "162bba83fbbfe53f338d365cb2b95e54cdf9bd5c", "sha256_hash": "79985aa176fd5b4a528a40efbfe9cecbd6cccf6c168123134e4b7566eaae05b4", "size": 74128, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d37b16597503b5bc72dd20ed9b0061565bce7841", "file_type": "modified_file", "id": "file_79", "md5_hash": "c4fcb29035a817cc14f45304c4d2490e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\p1l10vzx4hd3-c.mp4", "sha1_hash": "d37b16597503b5bc72dd20ed9b0061565bce7841", "sha256_hash": "4c13bd5c2a840fe2698e48900d9e5a2d225018410104ab0739a6ee816197c36e", "size": 8016, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ad87228795e5c5f35f0beecae9535607c3b6ad2e", "file_type": "modified_file", "id": "file_81", "md5_hash": "ef5e1f614a58744f99a63faae1f07cbc", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\u8xibbuo9vcag.mkv", "sha1_hash": "ad87228795e5c5f35f0beecae9535607c3b6ad2e", "sha256_hash": "2f0538dcb5a3fc252bfb660e65f218f482491202bc4cbac19e7f295507c5d1d8", "size": 47994, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a6617a5f0203ea9c75a3012cbae6ab87f497f31f", "file_type": "modified_file", "id": "file_83", "md5_hash": "77c363aa0b79f3d0d3668d81ecb9141d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cpccb0b.swf", "sha1_hash": "a6617a5f0203ea9c75a3012cbae6ab87f497f31f", "sha256_hash": "0e02cfb29fea57bc04a3c47f50279cbcd2b82bc0c8e71d36413805de1c73bb6f", "size": 14819, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f00a7c057ca940e40c09389e96080ff1d23300c2", "file_type": "modified_file", "id": "file_86", "md5_hash": "2ef50514bbdf5c1fb1d99df1003680e4", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\pgluhotas6kwmmfsdl.swf", "sha1_hash": "f00a7c057ca940e40c09389e96080ff1d23300c2", "sha256_hash": "bc12ad5610ac4c5278903dd2afd1c8c66180a1c519ed54f4c998c8f45124de70", "size": 65471, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/44217fb10c26be8043cb8e1f8995a7a0616d948a", "file_type": "modified_file", "id": "file_88", "md5_hash": "224edc872eacbcafe10cc214a8d8f606", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\6e5-hpmrbs.mkv", "sha1_hash": "44217fb10c26be8043cb8e1f8995a7a0616d948a", "sha256_hash": "f88670028a1bc60e4b18741205e4d4a34f8cf076bc2a4d00e4c1e8b55619383f", "size": 11200, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/06f4b83bf0e1cd5fe9a338e2d436627c4f634555", "file_type": "modified_file", "id": "file_91", "md5_hash": "7727271b003ab118e5a7ee4f46935aa0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\6gwg.flv", "sha1_hash": "06f4b83bf0e1cd5fe9a338e2d436627c4f634555", "sha256_hash": "6f53372a64e6aa4a87218501439ea4d762b340e2c876ed860b40d58d71b2dd92", "size": 100224, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2293b64dd2a55424b9324ee43e81126f8118e585", "file_type": "modified_file", "id": "file_93", "md5_hash": "2c531982707a0d2bf59074d62157b4b4", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\gxfzekk51.mp4", "sha1_hash": "2293b64dd2a55424b9324ee43e81126f8118e585", "sha256_hash": "62dabff92059c12969278fa6d0cd937db0c421bc9bf2d03b1862760d83749382", "size": 86064, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/157b1734ca63de36fba45139b374d21786bbc389", "file_type": "modified_file", "id": "file_95", "md5_hash": "cc3026377aba30e4133e5fce0bb76937", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\li6eau1sqq2.mkv", "sha1_hash": "157b1734ca63de36fba45139b374d21786bbc389", "sha256_hash": "47e13837c48b5d49d11675d8e387e57504166d0957c68d17cb5a03cf591e5bd1", "size": 99984, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a5dc55caddf3c00c8ebe8bd5c703256bad2da952", "file_type": "modified_file", "id": "file_97", "md5_hash": "22b8453bc206080fbca0de949a9bff50", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\p17xszau6p5nex19v.mkv", "sha1_hash": "a5dc55caddf3c00c8ebe8bd5c703256bad2da952", "sha256_hash": "1600762b28cd5fd906eec2d17dfcaba6fdd1d47cedc7c3e0dca77645667eca43", "size": 80088, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9a0def13f02c4680d9bb499e406ee70049789591", "file_type": "modified_file", "id": "file_99", "md5_hash": "0b1b91e03ccdf4eb9f73ee409be5e17c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\qopwqzk.mkv", "sha1_hash": "9a0def13f02c4680d9bb499e406ee70049789591", "sha256_hash": "09c06b2417d218510ae018c5572d9a6e473f7754f6ed606e960d4fe46bbc743d", "size": 15237, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7236a7fc759079d2bb585a4965abbf117ec7b37f", "file_type": "modified_file", "id": "file_101", "md5_hash": "3349fa04afe142e3b99cd9812bdbd1e6", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\u-mjrv.swf", "sha1_hash": "7236a7fc759079d2bb585a4965abbf117ec7b37f", "sha256_hash": "3d6909f8e1048412e03a1e0b5a7154a7d7a693b6e95840098229dad9f0637f20", "size": 25264, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/763d4427b0d6e6b2b7ba36516c8b98296b18aa92", "file_type": "modified_file", "id": "file_103", "md5_hash": "16c7ee5f1fa526ac4802dc6b46685f2c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\wyrssbqc98w\\jngbvbxt2te.flv", "sha1_hash": "763d4427b0d6e6b2b7ba36516c8b98296b18aa92", "sha256_hash": "307ecdb45c3220a1d9db865e5cd134b219525614fe2c5850504134fa0891b750", "size": 83952, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a5fc0bd86905e48f5f8ebb054463e4671f3213e0", "file_type": "modified_file", "id": "file_106", "md5_hash": "8e55130411fb86e461cac2b1786353aa", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\gpyspnb\\wyrssbqc98w\\xfnky9jskllvnzza0q7k.swf", "sha1_hash": "a5fc0bd86905e48f5f8ebb054463e4671f3213e0", "sha256_hash": "ba3d8c13f3de0bde5ed1a4154c9f8de820891a8234c49417577feb9e2bbdccd9", "size": 67984, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bc138ad598b761a24e0d0013cf64d86dc4fc140e", "file_type": "modified_file", "id": "file_108", "md5_hash": "94fbaa99139c9d10a02bfc36ac9de466", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\cn620-gsia4nyyycofj5.mkv", "sha1_hash": "bc138ad598b761a24e0d0013cf64d86dc4fc140e", "sha256_hash": "b1e9c09cf2c3eabc1c4c394d756385daf0ed24b4c23a68d646b660fe6fea512d", "size": 63439, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a10e5dab1ca75408740ce320a4ffa30703ff4855", "file_type": "modified_file", "id": "file_111", "md5_hash": "710e3b7a9024eaab14b0f4ca641b75d9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\tt_x88h6 pabcl7r-.swf", "sha1_hash": "a10e5dab1ca75408740ce320a4ffa30703ff4855", "sha256_hash": "f967457c20a83bece1ff8ab326cc7b6354c8f5ca9d37daf0c9511e6a4665faeb", "size": 100320, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c238e5b64433873f13430a7d7210779ac149145b", "file_type": "modified_file", "id": "file_113", "md5_hash": "aab7e0c401e157c1c2578244eefe5fab", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\z5nygqlxcnl5cc-.avi", "sha1_hash": "c238e5b64433873f13430a7d7210779ac149145b", "sha256_hash": "8364c334ff92f20ac6b24b1d8bf77b98421d16143a6edab55dc938b2a16743de", "size": 56400, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b4d33f1cf53cecca4886ce8d2dc5e4db905c0a01", "file_type": "modified_file", "id": "file_115", "md5_hash": "c3b8766fb80ddf42509e7f761928dc30", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\4tnmmqdfquco23log.avi", "sha1_hash": "b4d33f1cf53cecca4886ce8d2dc5e4db905c0a01", "sha256_hash": "8e61c5186a0dfff841d34d4dedba3589455dc0f82dffb09b3a809403ebf5d29a", "size": 69120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f9b029cc2c1a8d832a6a3db9249ad9a536eb53ec", "file_type": "modified_file", "id": "file_118", "md5_hash": "4a6889191bccb24e074c8c8c38412edb", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\9jzc.mp4", "sha1_hash": "f9b029cc2c1a8d832a6a3db9249ad9a536eb53ec", "sha256_hash": "2a526ea714599dcacb6bbbbbd4caba2866f483b2b8484a37a0855db68c9e19c0", "size": 11286, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/df6bea5d708fb2afe2052673928401fd946d62af", "file_type": "modified_file", "id": "file_120", "md5_hash": "7ca5c244029c3c8be3219c37cc5c6fa5", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\fwol9dbwif.flv", "sha1_hash": "df6bea5d708fb2afe2052673928401fd946d62af", "sha256_hash": "6face97dd1e3c6aef75551648680b05a670e34e8824462b68d627ccce635e418", "size": 14553, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/65e64716db0da062105d70ba2afa2ecff90fd9c2", "file_type": "modified_file", "id": "file_122", "md5_hash": "ba8ccb3fdcee2914c38bce0524e842b8", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\o8eem2rfs_my3eq9rg.mp4", "sha1_hash": "65e64716db0da062105d70ba2afa2ecff90fd9c2", "sha256_hash": "f8d7120d341931fbbcfa46124bd7192f7dbc2f10d5e7d6bc33eee61c5cfa052b", "size": 80536, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cf8d51a8866500327d11a32696c56b6292be4561", "file_type": "modified_file", "id": "file_124", "md5_hash": "bd974c8625ad3b525bfcd5bc7ca38035", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\xbh9xwx0lpzggdjbiti\\cxqvyrkp8k1us\\j-xye\\s0d9d09esgnym8fvdwh.avi", "sha1_hash": "cf8d51a8866500327d11a32696c56b6292be4561", "sha256_hash": "19f5df5f700308b91eb93b30ea24fee2c5bc10f2a74a357b97d244d619871097", "size": 10840, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3529e9ca4db6e2dde3252cb17311ffb48bff3801", "file_type": "modified_file", "id": "file_126", "md5_hash": "4ae1c4e97f55af4e88994edcace7da04", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\dindjpm.mp4", "sha1_hash": "3529e9ca4db6e2dde3252cb17311ffb48bff3801", "sha256_hash": "a777066c67f3326bd8de19d3d77345345d7ca1e7720329267caf479bc0368495", "size": 84768, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/72fb97c7ca9c532b0d374e13d3edd23528b93230", "file_type": "modified_file", "id": "file_129", "md5_hash": "36950664f74e1b45f63a64ad3198c4c4", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\gppag7bkp9yd0gqxy.flv", "sha1_hash": "72fb97c7ca9c532b0d374e13d3edd23528b93230", "sha256_hash": "1a2b8b094e6ad3f6a08229865269e08f1f6b7addfbdf0cc8eb5d2a812e97ac30", "size": 82107, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ac7999e33a532a057f2bc5c5002cce9139377fc1", "file_type": "modified_file", "id": "file_131", "md5_hash": "fc1b8206ef863f678da28ae60ff32324", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\gx_wpidl1d.flv", "sha1_hash": "ac7999e33a532a057f2bc5c5002cce9139377fc1", "sha256_hash": "1f314cf51e1aa8b12f451de8f0b25133200e20e8562e8c1e3cddf5305e91e0b0", "size": 75175, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3e0379560c88f8c49c9bf53d4a2567996f17b929", "file_type": "modified_file", "id": "file_133", "md5_hash": "a937f1f839db02afb42d1607d1ded6e0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\nxloupbusenpl3p-\\wnvoa3g9jp.avi", "sha1_hash": "3e0379560c88f8c49c9bf53d4a2567996f17b929", "sha256_hash": "4f33edcf69278ac37b940a4eda0741af35ba6b54d261723c27518704e82676f2", "size": 19552, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e60eaf40ee03bb331bf4f80570e2f91048e553d4", "file_type": "modified_file", "id": "file_136", "md5_hash": "43ec61be6fd526095167936b71b9c80b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\29fvawn e8kitezwwn.flv", "sha1_hash": "e60eaf40ee03bb331bf4f80570e2f91048e553d4", "sha256_hash": "2e6d24776764e1a69b4cf04bbe6938b2fce888d9e0a4d92086bb7c10ca2745d6", "size": 66832, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1fddce70e9c76b8e19e6a8cdddb037b93816aa9a", "file_type": "modified_file", "id": "file_139", "md5_hash": "3608a2b7bad77eb62fa08acc7860790b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\a6mtdotp8ju.avi", "sha1_hash": "1fddce70e9c76b8e19e6a8cdddb037b93816aa9a", "sha256_hash": "4f570434413579e169995ce8070bf8d8532d0e6bb283e81e3a13d01889815f69", "size": 63255, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/576536644a6cd6cef1ebd34f0f61f6332396b24f", "file_type": "modified_file", "id": "file_141", "md5_hash": "9592d4228871918fe89dfd41f35f2519", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\ezsh9_u.flv", "sha1_hash": "576536644a6cd6cef1ebd34f0f61f6332396b24f", "sha256_hash": "7f449b69ec6e80ef67ef543350e12f2af51a60d7e5a3a89d404f822ac7c5ce8b", "size": 90240, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9de74aa70b9160dcc0454a2b60cd84c6960635c6", "file_type": "modified_file", "id": "file_143", "md5_hash": "9054674649197d9a0c4cff7331c123f4", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\8klt4ds_wbyaiwwtj\\waljyrb.swf", "sha1_hash": "9de74aa70b9160dcc0454a2b60cd84c6960635c6", "sha256_hash": "a4c07abb692ab47758373a5430088a0fdbc7a5328eaac1f0cf8f5d9439b9001d", "size": 63027, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b3d8f3ba307b40c3d24350621282b6a707fee3d1", "file_type": "modified_file", "id": "file_145", "md5_hash": "59c24a41d3b59a62c2332684cdf7a2c9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\auvu5oo_3gglwzkk.mp4", "sha1_hash": "b3d8f3ba307b40c3d24350621282b6a707fee3d1", "sha256_hash": "377ae13f6d315cb476f6b2e70531ee2b56e4b479b8afe2a0e4f7d50329c91673", "size": 17536, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a0d8bdccfeb75d91c92c37ef9c8e27270ca66123", "file_type": "modified_file", "id": "file_148", "md5_hash": "998056d7bb4782afc1fe5dd83831b349", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\kmleb81ee9b5n1x.avi", "sha1_hash": "a0d8bdccfeb75d91c92c37ef9c8e27270ca66123", "sha256_hash": "e57bb617df558bf06851dbead8bb94a488a7d59f0585d9b6d303737e76212765", "size": 36512, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8e2afec244434d71356ce99f54eb2a060b186fd4", "file_type": "modified_file", "id": "file_150", "md5_hash": "afbc6aae9a38e174bba006c3eed12fb1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\nmno7w-y-y.swf", "sha1_hash": "8e2afec244434d71356ce99f54eb2a060b186fd4", "sha256_hash": "d722f4cc88e9845f795364929d9a39dfe3dceeb94a6178c498d5fc984797d047", "size": 56592, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2ca70859374af74b538e9d2dee9aa5c6f07076a4", "file_type": "modified_file", "id": "file_152", "md5_hash": "08cf7a35d11c46ef9f2636134600a86d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\fvnqxqgywua5.swf", "sha1_hash": "2ca70859374af74b538e9d2dee9aa5c6f07076a4", "sha256_hash": "d7207d75687dcc2265408367f777e000e2ca602cc61940275efa6bc1dfbae30a", "size": 87360, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8f78ef7d1c1cc1458b83ac4f6f845449a9464bf9", "file_type": "modified_file", "id": "file_155", "md5_hash": "3f0d9b18e92cddfe21eb116820e72a56", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\inom_uv1i78k.avi", "sha1_hash": "8f78ef7d1c1cc1458b83ac4f6f845449a9464bf9", "sha256_hash": "dd2ce7ba60461cb0302fc03576843773928d1fc4d13cf480ca79c2b516825a3d", "size": 72032, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/53ed9157075b7aa18ee2abec0419a623c4acd2a5", "file_type": "modified_file", "id": "file_157", "md5_hash": "df53e775ef95e9d4c47ff79c72935cc1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\akftbjqu7\\ajr9qn-j2iqxfffeuvm\\l6wybm_d_r_.mp4", "sha1_hash": "53ed9157075b7aa18ee2abec0419a623c4acd2a5", "sha256_hash": "58c9eb8125df9d1653c419f73e3dc5d0528682a8bd74a47209ba75802c678fd6", "size": 63433, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f53b0cc38d4f8c6b30926e357e63d6cbe5d5166b", "file_type": "modified_file", "id": "file_159", "md5_hash": "c4c1f7faeaa84afea0455e3ad7466095", "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\desktop.ini", "sha1_hash": "f53b0cc38d4f8c6b30926e357e63d6cbe5d5166b", "sha256_hash": "7fc129f00a30303e0fae704350f13d9534be76909e6961261677e3b75d960a80", "size": 1472, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/db060cce54618b30a81ef32e3ab32413cc98df51", "file_type": "modified_file", "id": "file_162", "md5_hash": "67a89b1d4df7926bb1282fa543e092f0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\everywhere.search-ms", "sha1_hash": "db060cce54618b30a81ef32e3ab32413cc98df51", "sha256_hash": "0f7ad004fc0f95aea113801039197f9c33c45f1953356bb603ab97c109396cd3", "size": 1200, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c7fc75a79d8556a2c8862f39a7bd13df6d800be1", "file_type": "modified_file", "id": "file_164", "md5_hash": "9f661fc1d668f3df14e769547e7beee1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\indexed locations.search-ms", "sha1_hash": "c7fc75a79d8556a2c8862f39a7bd13df6d800be1", "sha256_hash": "e81325733aa1be43630ecd9a9cba0cc6e69b9bf71ac8262233e05e8500eb5cdc", "size": 1200, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fca1d2e592d8698781d386f7ce2d310384c5853f", "file_type": "modified_file", "id": "file_166", "md5_hash": "d2c3bc6c2e874a4e62d5752742d6a26c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\saved games\\desktop.ini", "sha1_hash": "fca1d2e592d8698781d386f7ce2d310384c5853f", "sha256_hash": "2268250d88125d513d73334d7ecfd5c0ec075c5639646ac99e17bf8220e96c67", "size": 1232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e43e831e8a6648909cc0480f02a6a1423f148ca2", "file_type": "modified_file", "id": "file_169", "md5_hash": "ac9f3f9c26338af80c9ba05a1b5f64b0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\0hk3ferwlwmdegnqx0.gif", "sha1_hash": "e43e831e8a6648909cc0480f02a6a1423f148ca2", "sha256_hash": "d2688170b4418761121d914e2c7573fbbe6b326b9544be772c99d3ae547efbe1", "size": 25917, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4a2c061fc5e340860ab6b2f16d5f2ad1d62e2e82", "file_type": "modified_file", "id": "file_172", "md5_hash": "2dbb0b4cb0b8acf258f575c13848af0c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\7qdjrw-yomo-k-z7n.jpg", "sha1_hash": "4a2c061fc5e340860ab6b2f16d5f2ad1d62e2e82", "sha256_hash": "e6dfb245a478614c79c30c89345670b51f6182c37bccc7ce258d19076ebc8d4c", "size": 7280, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c9b06d0f911c553a516f1e3066fcd1f3af08a473", "file_type": "modified_file", "id": "file_174", "md5_hash": "3dbf9c15339199ca1e20853ace4b31d4", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini", "sha1_hash": "c9b06d0f911c553a516f1e3066fcd1f3af08a473", "sha256_hash": "4d8b6c410fde466c6a91419bd42ff117b20a0142ecbf655f2b5c7e18e2b30157", "size": 1456, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8245ac00ca2d1977b65a96d15aa601001ff58199", "file_type": "modified_file", "id": "file_176", "md5_hash": "7caf7deb64e49cce7593c857445d9707", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\h7trdzq_5g.jpg", "sha1_hash": "8245ac00ca2d1977b65a96d15aa601001ff58199", "sha256_hash": "6bdc520d1fa0813a5849e335f463903b59082bbac8a66c5143c26cd9b539fcb9", "size": 24352, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ca910c5addc99824de22d683676ab0e7bbd0c802", "file_type": "modified_file", "id": "file_178", "md5_hash": "bef17db6f8008201e2eee7fd8215e509", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\qrw9a sahnuzyrbroxd.png", "sha1_hash": "ca910c5addc99824de22d683676ab0e7bbd0c802", "sha256_hash": "6255803a4dd36fa4b6b32c5152151fb9414794203bcd7b676c79d12731a1cb03", "size": 52672, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/339bdab658b3cee4b1dfbd555d67b97fa002a177", "file_type": "modified_file", "id": "file_180", "md5_hash": "6221a08d21072faca2c26a7097305663", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\qtvkcwkzzwibwteiqbm.jpg", "sha1_hash": "339bdab658b3cee4b1dfbd555d67b97fa002a177", "sha256_hash": "f5ff60ac82babbb8ea59c7690f6ed00abbd182317eef555b0864a53b2e802b3d", "size": 86848, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/791af3ac7e44f90ef0aa93c3c6aed09210b47f19", "file_type": "modified_file", "id": "file_182", "md5_hash": "cb536c6ba05ad084eff49534b411798c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\th8eu.jpg", "sha1_hash": "791af3ac7e44f90ef0aa93c3c6aed09210b47f19", "sha256_hash": "616f462f32179ebad3ccc620412868de4ff8653e13f2a0f3407afc4c3d4707d1", "size": 64444, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2b1d5c41a36841dce08c429493aa8041277a6029", "file_type": "modified_file", "id": "file_184", "md5_hash": "6ffd4e7f9b56f035a66f15814759b63a", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\xphr2tjjz.gif", "sha1_hash": "2b1d5c41a36841dce08c429493aa8041277a6029", "sha256_hash": "3271d5f78d0e0a9d15c4c0434ae1beaab48fdbe953f649d7be9dfae66fce2f7c", "size": 91024, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/66ef0c636edc9f29d4ccf63034dc37e8ebf88ec4", "file_type": "modified_file", "id": "file_186", "md5_hash": "b0d042871f93477b4b37c70d7629837d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\desktop.ini", "sha1_hash": "66ef0c636edc9f29d4ccf63034dc37e8ebf88ec4", "sha256_hash": "af01d088ccd7258d620311b66d6308413f9a5b618df0a162b66461913890d241", "size": 1136, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a886b4e80fd4f7e4e1c6f891c045b38ab0997118", "file_type": "modified_file", "id": "file_189", "md5_hash": "a8594fdd545b6bb17c417f4873165714", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\-9fnhcfha2.png", "sha1_hash": "a886b4e80fd4f7e4e1c6f891c045b38ab0997118", "sha256_hash": "748f2bbfb8824b5e10ae6479c549f6f69647d25377479cf85b58529ddbae894f", "size": 27223, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/46e1f7efd4a53808d430e12adfd8728f315abd60", "file_type": "modified_file", "id": "file_192", "md5_hash": "cba8de21ea1a126cfdc94024e40f0f55", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\9xuhi63.bmp", "sha1_hash": "46e1f7efd4a53808d430e12adfd8728f315abd60", "sha256_hash": "f4d65c1671191464475c8d6c7f61bf0d8fe07be14bbb27977cc3670f0612445f", "size": 53504, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/982c5debeded46dfe4e4a251971702301159bbca", "file_type": "modified_file", "id": "file_194", "md5_hash": "12d9125b7719dd59f98119fcb76c7cde", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\hkqhg.png", "sha1_hash": "982c5debeded46dfe4e4a251971702301159bbca", "sha256_hash": "046e39766f992c5785cc76142a09abe4fd9b305a4a0e0140a6c8370b455740f3", "size": 55008, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6b3b47784a3652ac50e44ac130d71389ea8a1e0e", "file_type": "modified_file", "id": "file_196", "md5_hash": "30578e80f0a80370a8c6d465f0b1a195", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\qhasofurdpjwbi.gif", "sha1_hash": "6b3b47784a3652ac50e44ac130d71389ea8a1e0e", "sha256_hash": "b930acfbd9d9b5cef9f2e53d1c84765da1a6990c42e78fe247e944fc3df4caa5", "size": 98657, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f0db99e5d5cfc01b857635cd9a84645f36ddd0df", "file_type": "modified_file", "id": "file_198", "md5_hash": "5b0b91210560fe6519b94a7b619c691e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\rtevorrnw0ui5otj\\x1b_.bmp", "sha1_hash": "f0db99e5d5cfc01b857635cd9a84645f36ddd0df", "sha256_hash": "9c64bffd9d021a4292cc55882a66fe3c6b7b7f4288fe1fba6603618de6168d0f", "size": 36880, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d040eccbbb921c559a00c81c2c9ef27f7a858bc4", "file_type": "modified_file", "id": "file_200", "md5_hash": "5e79772c1bf60f453460c5abc32d5257", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\as7lziutzivnqsdmixnj.jpg", "sha1_hash": "d040eccbbb921c559a00c81c2c9ef27f7a858bc4", "sha256_hash": "52e64a74db7f147f4477d73874694bbdc93daf35f83e04fdefd806236b6098b3", "size": 36528, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a798f721381034bebe68604bdbe2a66366a29705", "file_type": "modified_file", "id": "file_203", "md5_hash": "0539fa8eac70342f38f39a2aff0b53b9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\d_fv7 prsx.jpg", "sha1_hash": "a798f721381034bebe68604bdbe2a66366a29705", "sha256_hash": "94e9f7d040b6f5608c78adbae3b61bd895e3b49e7edc0f97b227d620aa2eeb47", "size": 33655, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9015b1b9c7d81a959e33946dbc4bc036cc7a4457", "file_type": "modified_file", "id": "file_205", "md5_hash": "53ba80cd0472f0698fd1aae0d73ae925", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\kovnpdmyrl.png", "sha1_hash": "9015b1b9c7d81a959e33946dbc4bc036cc7a4457", "sha256_hash": "48f027c9baf7222c23df41960d3780f75b4f169640f35b92be2cd2651c96a3ce", "size": 47647, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c97904a3ff6a9e73ad38051e05e87decaba9a221", "file_type": "modified_file", "id": "file_207", "md5_hash": "077d2fac723f1cbd3d6bdfc1fcccc4b7", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\ugmctukfcxobe.png", "sha1_hash": "c97904a3ff6a9e73ad38051e05e87decaba9a221", "sha256_hash": "7d919692580b8bd577a1360c5506249a580d1ffb78bc03f2cc07ed3f6a7e4f9f", "size": 96079, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/22ddf8d15fc919b28ac880548c7fbf0d4b8aadb5", "file_type": "modified_file", "id": "file_209", "md5_hash": "ff38a4f3373f37969a54c7ceb6223b9c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\kueb8-smvm\\ulsdcvkqeuxlv ur2xy.jpg", "sha1_hash": "22ddf8d15fc919b28ac880548c7fbf0d4b8aadb5", "sha256_hash": "de26b309e0ba1723040055c01ca175326fdb25658c5d4f2678435b16772834b7", "size": 46756, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8ab4945701ba3219e2ffdb58726d345c4dd79d48", "file_type": "modified_file", "id": "file_211", "md5_hash": "5cca10bd6c111274005acf6f8db9d76b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\desktop.ini", "sha1_hash": "8ab4945701ba3219e2ffdb58726d345c4dd79d48", "sha256_hash": "bd7dadad415f1e07336a09ada99a12632c47dcf7fb5a6de72ab9eaa5044856ef", "size": 1136, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/50d754005ca12f35030bb9fba64998c17f460fa7", "file_type": "modified_file", "id": "file_214", "md5_hash": "e91fcc5a22a514f23ab756ab8e965e88", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\3kc4ze4gwjhznr0zwjv.png", "sha1_hash": "50d754005ca12f35030bb9fba64998c17f460fa7", "sha256_hash": "d05103743b01d72da17f90cf0c1216ca7a9e01164df05337456444675c02b070", "size": 63753, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ba1d212d9e0133221334f84effe4ede67597d01d", "file_type": "modified_file", "id": "file_217", "md5_hash": "af89d4843dfef53adccc8dc0ef2a8934", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\8fsdui62a 2pmyacyjt0.jpg", "sha1_hash": "ba1d212d9e0133221334f84effe4ede67597d01d", "sha256_hash": "1131be65c1eba551c686f4ddbf5edd84f43f0b8720513530dea691e502479026", "size": 12325, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fd31cbdc91fa71fb9f18e29dd506905f0d5ea307", "file_type": "modified_file", "id": "file_219", "md5_hash": "97f431bcdb02fb152c69f0fe02419e3a", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\9n-4.jpg", "sha1_hash": "fd31cbdc91fa71fb9f18e29dd506905f0d5ea307", "sha256_hash": "760a7a2b099cc37d79aca7c4a44fdb8a970d0224b4f69ba64fe2f3f0bf797eb2", "size": 17568, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/79effbc7a1827648436550239433a1bed1ac4f69", "file_type": "modified_file", "id": "file_221", "md5_hash": "d7bf4fbff69ac4313be002d49c76f39c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\baym9st _guc-pmf1k-.gif", "sha1_hash": "79effbc7a1827648436550239433a1bed1ac4f69", "sha256_hash": "1674d71148be864775ed3c1c68f6b6ade5ad27d3abc77314c90e6c00a5df3a51", "size": 89568, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/01408887f8b4fca7dcf925b8245e4c15a2515a96", "file_type": "modified_file", "id": "file_223", "md5_hash": "542c2e3411ca3a681549cc1a98856d67", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\dy4knw.jpg", "sha1_hash": "01408887f8b4fca7dcf925b8245e4c15a2515a96", "sha256_hash": "58b689bb52fd767c33954049f14b10c91a6a5e148eb8104127d0161ad3a94b62", "size": 25056, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2219754d4bd725d44bf411c526c41480bc120186", "file_type": "modified_file", "id": "file_225", "md5_hash": "77fd1a6a20182d86d798362c119dc482", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\gfe4.gif", "sha1_hash": "2219754d4bd725d44bf411c526c41480bc120186", "sha256_hash": "1b378dd060e864fec50e1db866c4ecd212f948212c33fe804da903e8c2afb62a", "size": 43699, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/67d2f2dbdd9e52832ee21483d65b390ca534c5a9", "file_type": "modified_file", "id": "file_227", "md5_hash": "599d1503d5df5884c705682574796908", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\l6xswm755meyjgkn.jpg", "sha1_hash": "67d2f2dbdd9e52832ee21483d65b390ca534c5a9", "sha256_hash": "54081f08d706f60074bdef6e7f8d10c61d2a80af9c9ba8378c7c2113ac986d44", "size": 33679, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/42a4788a39c115d40c18c403c17c08927ffee412", "file_type": "modified_file", "id": "file_229", "md5_hash": "bc53f8db3d2219662d16428f33bc9c3d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\olgvhwydqyi0lakbu.jpg", "sha1_hash": "42a4788a39c115d40c18c403c17c08927ffee412", "sha256_hash": "5ebb588dec0ad24e05480a2eae6bdbd0ad2650eb2b6e1447587cb65aab269859", "size": 63956, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e365174a03247c97fc9ee07248498d3f860b80a0", "file_type": "modified_file", "id": "file_231", "md5_hash": "4011b193c3ea477cbdb7878b5e6e4ace", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\rjzgheo.jpg", "sha1_hash": "e365174a03247c97fc9ee07248498d3f860b80a0", "sha256_hash": "ebe9f6bcf0406f51ec1360024a0baf809abfc4cfa9c8f54e2acf6545eca4a6fa", "size": 74272, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/62aa0ee530b1684ac4a3308d1a226c8a2b999a45", "file_type": "modified_file", "id": "file_233", "md5_hash": "bf95a5b5530da4c567c457a7405ebb09", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\5b opcyk dpcoz.jpg", "sha1_hash": "62aa0ee530b1684ac4a3308d1a226c8a2b999a45", "sha256_hash": "975f8a21e4602b9515be89d331d38b1155f9259adc53e09f3e47707f91236b48", "size": 67648, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ff225983c83fdeac6d24e00bc28690dd9ebc0d23", "file_type": "modified_file", "id": "file_236", "md5_hash": "4c7f676d50a765b1c881721991fe70a9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\epxxkihhqhnuu6fk.png", "sha1_hash": "ff225983c83fdeac6d24e00bc28690dd9ebc0d23", "sha256_hash": "cfecb0949cb1b424b3b14aade255d501e8960e263d3a5311e896ed045f6374ab", "size": 101872, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cc287a3da490d7e841759a957fdec13e4cd82e2a", "file_type": "modified_file", "id": "file_238", "md5_hash": "5ff39262daafd22d49661e9bbb4937fe", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\v_voep\\ptut.png", "sha1_hash": "cc287a3da490d7e841759a957fdec13e4cd82e2a", "sha256_hash": "796c0c58d34b7be60b69345a52494b8f3ff6261ae18323719503e17a125350f4", "size": 8000, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f35051ec0f0ee9850b1defa2e76b16027bb25166", "file_type": "modified_file", "id": "file_240", "md5_hash": "928d739af09a9f89057dbc12faeb53c2", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\-5ln7dorug9.png", "sha1_hash": "f35051ec0f0ee9850b1defa2e76b16027bb25166", "sha256_hash": "1a1169bfb1d5c2c7dc22af9cf6bd0745973a62b94c2b415598c747335a0996a7", "size": 47358, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2cabfec4627b0f99dc431fc378822716385c6030", "file_type": "modified_file", "id": "file_243", "md5_hash": "1ab1ac77b6519d6d5e64284749dcb175", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\f0xhzrypqok3ky78oshs.png", "sha1_hash": "2cabfec4627b0f99dc431fc378822716385c6030", "sha256_hash": "00765bc7e24a8493a7d6b86414551b3ba60a33561f631a3623b61aea3c578696", "size": 47307, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7c511012208b5d52b8610795bc4519f2ada50ab2", "file_type": "modified_file", "id": "file_245", "md5_hash": "b44ff50eb8a7d805974b9d748c93fb52", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\i39wbfumyp6nr8z.bmp", "sha1_hash": "7c511012208b5d52b8610795bc4519f2ada50ab2", "sha256_hash": "ef5a76511fdbdd3bee2f4d07fad1cf1a1a805be55af41705faa2daa9daa51996", "size": 93263, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2535230322be3bc8a95c223aed64435dfead5cc6", "file_type": "modified_file", "id": "file_247", "md5_hash": "f0bf7f7c785877b62a459ffb5e32ebe5", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\mazf5-.bmp", "sha1_hash": "2535230322be3bc8a95c223aed64435dfead5cc6", "sha256_hash": "118fb7d5ede3c8190d5bb77935b2e3dd7026a03279099e7cdb00b1ff89b374c2", "size": 38032, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e8a412c9f56fbe883167bd6ead7bfbd42fe9d44f", "file_type": "modified_file", "id": "file_249", "md5_hash": "04b3c7e69561c2888e7a5b84ab9f6d59", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\tlhdeof6pkj-_rumjy.png", "sha1_hash": "e8a412c9f56fbe883167bd6ead7bfbd42fe9d44f", "sha256_hash": "d87875105600cd1c0aace4d8bf777135cc51328c22b204a295090c9a68e6bb7e", "size": 102576, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/75676b5f9d301b1e37d5c1dc2ee5e82cb9ef5045", "file_type": "modified_file", "id": "file_251", "md5_hash": "786713f927ab73bf30c7519cbc9a0544", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\abvgeclaklpmc\\tq6halxmym.jpg", "sha1_hash": "75676b5f9d301b1e37d5c1dc2ee5e82cb9ef5045", "sha256_hash": "4be5ad07ac1aa15652184451374b3b874826fb2d72643211aab4b92a94f8aaed", "size": 40752, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/dcb6b5f5d6420e92473415630a11c074c865fb1d", "file_type": "modified_file", "id": "file_253", "md5_hash": "f9684a45f6842e4b1cc3d62a8aca8d0c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\9wi6gc3o9czj\\6ghfbg6r\\ydgp6n.jpg", "sha1_hash": "dcb6b5f5d6420e92473415630a11c074c865fb1d", "sha256_hash": "d5d0e1ac0f2c1b53ffab0344f4f54556ee059759fa7e64d61a8f952daa9458a2", "size": 30010, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e5f5c7cf7b6d6e5ae349dfb6fb2f02f95130a79c", "file_type": "modified_file", "id": "file_256", "md5_hash": "0072fd5678c831e896556403c9a56dc5", "norm_filename": "c:\\users\\ciihmnxmn6ps\\onedrive\\desktop.ini", "sha1_hash": "e5f5c7cf7b6d6e5ae349dfb6fb2f02f95130a79c", "sha256_hash": "cc05acaabf026ed6bcd29908ae5079735617583855e4fd6557d8e310154af02e", "size": 1056, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/250d53eaf9025c4559cdaad0b27f7ed435f1a782", "file_type": "modified_file", "id": "file_259", "md5_hash": "2c90f23fd3114719e5dbaa82caa89f90", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\-gv6hl.mp3", "sha1_hash": "250d53eaf9025c4559cdaad0b27f7ed435f1a782", "sha256_hash": "ebb0613399cc729b99177b5ebec4f245500a6e66ab9a052f92910d6937d6f691", "size": 5952, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7d348ab645d083ceed008810414fa7ef7a44e201", "file_type": "modified_file", "id": "file_262", "md5_hash": "b0fa6eab862c042066dc38fad71cabef", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\a7bhmqqgp.wav", "sha1_hash": "7d348ab645d083ceed008810414fa7ef7a44e201", "sha256_hash": "4fef77b6c8e7f4996e016a4e24c274e0000ee2e3f7efd1035b233bef8ab84ed4", "size": 32862, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4ca5f47e27d62693879f719b542b2904b0563b56", "file_type": "modified_file", "id": "file_264", "md5_hash": "c97099a5ebbc80d50d309d865880682c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini", "sha1_hash": "4ca5f47e27d62693879f719b542b2904b0563b56", "sha256_hash": "ad3c0c99182392975db23272978191ff9571c70e703c03a405338a777fc58be2", "size": 1456, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/dc9544ecd70bbde7a47e1c8e0566a7cd56a77d93", "file_type": "modified_file", "id": "file_266", "md5_hash": "0c76019d1dd59733e76144c42f6bab95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\fgplqzx t.wav", "sha1_hash": "dc9544ecd70bbde7a47e1c8e0566a7cd56a77d93", "sha256_hash": "b58d31ec4f4db1e03b94ed836f0da1d41d8e7372525d6496b5ebfd8e132bafb9", "size": 95312, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/293f8367e9af5a7fdc6c0236488f35e37d4efe47", "file_type": "modified_file", "id": "file_268", "md5_hash": "b007a5506f60a4dd110bacf3020a385f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\dckf.m4a", "sha1_hash": "293f8367e9af5a7fdc6c0236488f35e37d4efe47", "sha256_hash": "553dbc1b733af0c76ef0c3f3c7e922952243f6369c0d1ad8466168573233207e", "size": 29808, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1b5493aa25f317782189d937ad5ad82a9559a407", "file_type": "modified_file", "id": "file_271", "md5_hash": "e4093144803c7ad006ee5d2eae5cf5b7", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\dsupk7zl9jc7_qd.wav", "sha1_hash": "1b5493aa25f317782189d937ad5ad82a9559a407", "sha256_hash": "7b515183cebe5db526924ac367d388c1b837ab659c206cd5b099496a656cc2a8", "size": 21696, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/368a7817564586557f049a96d4f24a32ddb462c7", "file_type": "modified_file", "id": "file_273", "md5_hash": "f0ea0deefa136587fc6a510b1395a251", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ippvcsepbfwdelc.mp3", "sha1_hash": "368a7817564586557f049a96d4f24a32ddb462c7", "sha256_hash": "b8044b5eda6fbb828bddf30c03b8139cb8305c0d586d4b85f6e609ccc082259b", "size": 71968, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bba3aabb49cc0b4117c0b02e9cbfbe2aba2928f6", "file_type": "modified_file", "id": "file_275", "md5_hash": "f27d09d9b1f2a01da155b43943031bca", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ozuwudusfqn.m4a", "sha1_hash": "bba3aabb49cc0b4117c0b02e9cbfbe2aba2928f6", "sha256_hash": "ad5581fbde71925b779c79b29baa5e2c9979765981b5bfd5a363769352d45b4e", "size": 33572, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e78532985ce0a17447226d5d6529395226052e9e", "file_type": "modified_file", "id": "file_277", "md5_hash": "ac7657ac37ab2dad3dede5f0bb1907d1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\vnzuuijun.m4a", "sha1_hash": "e78532985ce0a17447226d5d6529395226052e9e", "sha256_hash": "7dec2fd091ed96b53bdb35ba628a2e527e75c675c448c52eb05cc1f1f8709102", "size": 89760, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bcd5d2cae4b888848a90ca8a63b37c4c2050c095", "file_type": "modified_file", "id": "file_279", "md5_hash": "6357bc54149cba544428784c0433f230", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\1fc6vhdhwaiuxr.m4a", "sha1_hash": "bcd5d2cae4b888848a90ca8a63b37c4c2050c095", "sha256_hash": "abdb19f2f52b16492433c58b4f3f92079aaeac3298aed2feadeaa188e07db67b", "size": 50944, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9cbbc6031e6808017669df470bb7a2e63f519f5f", "file_type": "modified_file", "id": "file_282", "md5_hash": "58feeb6c0a8d6b8c0ff50d78f28885e2", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\d0i5ilhq2cc66s_ealg.m4a", "sha1_hash": "9cbbc6031e6808017669df470bb7a2e63f519f5f", "sha256_hash": "608c971dfc4e0319f8e435d89976c085c51bbcfe137b7b7960a0fa7c2d5897b4", "size": 97408, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/aee3d0171814ba4e53f0868835b27937873dc417", "file_type": "modified_file", "id": "file_284", "md5_hash": "733585550054dc6ed95b4ec83420b6f0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\esxi.mp3", "sha1_hash": "aee3d0171814ba4e53f0868835b27937873dc417", "sha256_hash": "1343c6dcadfb0d04b39cf0260b68f5ab7b4dabbff0ee7c9fd5efd9b6c3932b40", "size": 82270, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/76cb14460a77226515cac081e58ba731df533f49", "file_type": "modified_file", "id": "file_286", "md5_hash": "41e5deb048024ef38b94630c5223d365", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\ew3rsnw.mp3", "sha1_hash": "76cb14460a77226515cac081e58ba731df533f49", "sha256_hash": "2069c416c8c16ce33d9b02a204f4194825afec85e895221cf0cafe7e7e8655e7", "size": 48455, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/90d40ce6670dce890cd09d346d68589b5b03ea9c", "file_type": "modified_file", "id": "file_288", "md5_hash": "0fb34c7d0f053d21d608b8ea277b28c9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\i42jovpae6wr.m4a", "sha1_hash": "90d40ce6670dce890cd09d346d68589b5b03ea9c", "sha256_hash": "a6f18da0473a435fd9b31667fa1ebe8e5db1d75f7f44ce1b50a7c7bc9cfe11a0", "size": 33215, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0d53566be4a391be7fd715af4f31941e4734803c", "file_type": "modified_file", "id": "file_290", "md5_hash": "fc490dee92d7ba28af2adb66db5aca54", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\k4en3jl_.m4a", "sha1_hash": "0d53566be4a391be7fd715af4f31941e4734803c", "sha256_hash": "d17ed4b8b9c6579694c17462c1f333a4e22b46a4295a3371e3574098cd62a4af", "size": 78963, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/50c9348cb4ef95a6400be8c1a87e9d15ee4c805e", "file_type": "modified_file", "id": "file_292", "md5_hash": "5d845b1ddf14fd713ba167b947d98559", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\oc7nraysldll.mp3", "sha1_hash": "50c9348cb4ef95a6400be8c1a87e9d15ee4c805e", "sha256_hash": "4fe8205178e31f39942f682e989f0b38661366393ee36e9dc259474709c46f13", "size": 13797, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/db1c51175b3e42a1fd0f2adecaf54c364c036438", "file_type": "modified_file", "id": "file_294", "md5_hash": "92d8cb8ebee0bb258d0ff45bba2bb6b7", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\605wo0ig7rv 5gkzsb.mp3", "sha1_hash": "db1c51175b3e42a1fd0f2adecaf54c364c036438", "sha256_hash": "b6077ff7a2a3ba47b36a1db551aaa36cb0d2e47f679429bf0550b60bd3429903", "size": 102544, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5ced5c633cd764396f3a66ebb33d70580c85d05f", "file_type": "modified_file", "id": "file_297", "md5_hash": "a04e323349b77ad51775718d94d07295", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\m1rlmk2akfhdrfd.m4a", "sha1_hash": "5ced5c633cd764396f3a66ebb33d70580c85d05f", "sha256_hash": "3452a2c547fa86a8458aef3b7df4401e93e4881d2d4ac252d3a78997baacca2e", "size": 29400, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9eb3ce342b9865c336423eb839a1ae6568e87c31", "file_type": "modified_file", "id": "file_299", "md5_hash": "b00326eb8d130047caf56c0246925ae6", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\pgszj43skzy.wav", "sha1_hash": "9eb3ce342b9865c336423eb839a1ae6568e87c31", "sha256_hash": "6e315628f59f2919f8329c624e822f963db94a8c92a5316a6509b5922ec13ce0", "size": 77311, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c24f5f84cf5b6027643abdb0b74cd3285f2c3507", "file_type": "modified_file", "id": "file_301", "md5_hash": "8d82a8ffae788d669b9ddcb04b39e04b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\yx7ef.m4a", "sha1_hash": "c24f5f84cf5b6027643abdb0b74cd3285f2c3507", "sha256_hash": "addfb6544509b015e79c673160ee3a6a393fe52ed68c442f13f37c7d811a1339", "size": 81512, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b2ae5640ce2ca2aa9d3cba017b0dba6fa76da4a1", "file_type": "modified_file", "id": "file_303", "md5_hash": "21afe0d57dab129e4eeb2e0f8e9e09dc", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\lce5uuov6td.m4a", "sha1_hash": "b2ae5640ce2ca2aa9d3cba017b0dba6fa76da4a1", "sha256_hash": "7b699621de7ead27680c2377132ad87d45f5d012aefddf3e1d5c8047f5bfa917", "size": 67168, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/259d3d85b41f3dffbd7a4ce1fdc551d2e574bc05", "file_type": "modified_file", "id": "file_306", "md5_hash": "aaafcd348ec71e590e2674469356ab02", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\vapnw9bykw_hbbp.mp3", "sha1_hash": "259d3d85b41f3dffbd7a4ce1fdc551d2e574bc05", "sha256_hash": "91469c74b9970b2e4165a35e9ffcaefd5436e46e62aae2f9cd28239595240a08", "size": 34416, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3e638590c658fe9271f7477afe57ac074206fc65", "file_type": "modified_file", "id": "file_308", "md5_hash": "4b8778a5461ddfcf01ea1ffa74ea30da", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\xuefhwntl3mf5omdlbh2\\tcotoe4f9fr69v\\x9tnf17hn1x0_ekcrc.mp3", "sha1_hash": "3e638590c658fe9271f7477afe57ac074206fc65", "sha256_hash": "16cbb794377ac9e0e71a9f831909d91f264fbd8422c7bcec1abbf2eaea76f31d", "size": 28919, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ef5af09875614c367f09e0dc4e64ba5f42b108a5", "file_type": "modified_file", "id": "file_310", "md5_hash": "bc1906627c022794f5083fa1e9d4e445", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\tfeyyxaopweg\\jfdazs.mp3", "sha1_hash": "ef5af09875614c367f09e0dc4e64ba5f42b108a5", "sha256_hash": "535dc7348f9508a832322bae74043c27fd59e5a4599414213f0b8a2cc3b8bcbe", "size": 5632, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/374f1e1b03d2823d1ff6ed9b88bc358e4fb4ffe1", "file_type": "modified_file", "id": "file_313", "md5_hash": "0742e8a807ed2e32afa17686ec6dc692", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\zopz\\ia1 8yogktf96\\tfeyyxaopweg\\pm7otm.m4a", "sha1_hash": "374f1e1b03d2823d1ff6ed9b88bc358e4fb4ffe1", "sha256_hash": "e9bb179e71217f4746c63941d9a67f59bbe38ce7de4a4915e5e85698f1713001", "size": 15248, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/78712f3c9015a24e34501d4c8ae43ee5d8c8e0eb", "file_type": "modified_file", "id": "file_315", "md5_hash": "6f6e2ecf0db7360f0afa5728831559b0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\e 0yavcuvr4xtgj0s.m4a", "sha1_hash": "78712f3c9015a24e34501d4c8ae43ee5d8c8e0eb", "sha256_hash": "45c7f50ca9507476362466b3479653a594b24af40b6f24a50c80f8c6ba341e36", "size": 64152, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4f6d8b6496fa017b30da91e5458de9793087710a", "file_type": "modified_file", "id": "file_318", "md5_hash": "c9bb8b82d67c18188946bcede0643e96", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\i30gioixb.mp3", "sha1_hash": "4f6d8b6496fa017b30da91e5458de9793087710a", "sha256_hash": "153ddd4d181120b7dd545a44dad7dd2c4be1cff9c5889dd29b13db6e55e12aff", "size": 61997, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/86233756e704378370f81a345f646e9ff955ea88", "file_type": "modified_file", "id": "file_320", "md5_hash": "ab1d36c557cd637ebc23b477c76d6c1a", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\ikm7 z01-mol8cw-v67.mp3", "sha1_hash": "86233756e704378370f81a345f646e9ff955ea88", "sha256_hash": "aac3772f64ce5e546a77ed492e4ac3ed20ffb62400871d1c062f40ed6d2c5f82", "size": 62468, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b201e0f59f05cdaae03c84ec51a47080c5e0084c", "file_type": "modified_file", "id": "file_322", "md5_hash": "427a283595977e77ae73ff64ca7f54fb", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\mrwbv.wav", "sha1_hash": "b201e0f59f05cdaae03c84ec51a47080c5e0084c", "sha256_hash": "3d30b015795eb0cfeb5d510679701fa0ba997a347999d9fc535f83e38d3914c6", "size": 43842, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e558e3eefb5a2fe5b3ba3aa19ed33f932b3fd77c", "file_type": "modified_file", "id": "file_324", "md5_hash": "3a3a2f0cf688051867da1a102a06bf4c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\ppqizb7pszmep.m4a", "sha1_hash": "e558e3eefb5a2fe5b3ba3aa19ed33f932b3fd77c", "sha256_hash": "8b24602303558287d88743d316d682a4638f2f25f6ba91ba7eba107f102b7675", "size": 51360, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e493c273c9500815c8a7cbe630507bc38e30b639", "file_type": "modified_file", "id": "file_326", "md5_hash": "0bae79acdbfa8768050dd71671578cd6", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\vm4enrsiqigsp.m4a", "sha1_hash": "e493c273c9500815c8a7cbe630507bc38e30b639", "sha256_hash": "b3aa9d9dfd8b5b072e3b35068e58a2853b4fa93d2c1797b6bc8567ab1344f63b", "size": 69040, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/307327956ec1124c4a945ad175779eb637d7bd58", "file_type": "modified_file", "id": "file_328", "md5_hash": "36ec66301c50b899fb4f26e0d6e0096d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\9qybl5jzyjkpk.mp3", "sha1_hash": "307327956ec1124c4a945ad175779eb637d7bd58", "sha256_hash": "6c313dd4858f47d61d0a618aebf65e98c2a06d649ba347f282bce38cbc282f31", "size": 96752, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/07666e5cb6475230aef594bb9c3993a3d0117471", "file_type": "modified_file", "id": "file_331", "md5_hash": "fcc60f00f0c916574574f596403c98a2", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\boyhfub.m4a", "sha1_hash": "07666e5cb6475230aef594bb9c3993a3d0117471", "sha256_hash": "387ed2ea2731052e631ef943a0d609ad3b346a1865fe6a877131db0bc91ed1c3", "size": 91962, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cc5a7e3f8c17d2a7dacd3624d82b40ac2f894ac9", "file_type": "modified_file", "id": "file_333", "md5_hash": "da1f34ad32348d864a69f3f26fd74705", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\cm_emr.mp3", "sha1_hash": "cc5a7e3f8c17d2a7dacd3624d82b40ac2f894ac9", "sha256_hash": "f145082df5097586bb5dd25e14a361d621d77bd14c4e174c7e5bb8c99aa39f8e", "size": 61871, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/04de33073d4f6bd653be579c0d3a019b28d3296d", "file_type": "modified_file", "id": "file_335", "md5_hash": "f68b9e595fa1d2cfe074d3329b315ecd", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\mzvj-71fzcsc6i.m4a", "sha1_hash": "04de33073d4f6bd653be579c0d3a019b28d3296d", "sha256_hash": "3bf2e46f349980e193421664cf4d4accfe28c49e48ef596653ef89fc868b9da6", "size": 25645, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7349f59264588f812d16dc0e2397b085c93f9325", "file_type": "modified_file", "id": "file_337", "md5_hash": "14d4489a821158afbfa5116dc33aae69", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\sjwerqq.wav", "sha1_hash": "7349f59264588f812d16dc0e2397b085c93f9325", "sha256_hash": "dfda495f4b70c219bee2b8b857e1c9e64e45908b33cc5fb6d709119151b986c1", "size": 41120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9ee6383f3e92cd745049320943b92e561e6b8d7a", "file_type": "modified_file", "id": "file_339", "md5_hash": "c63fb19280568181cd7e597a7a843798", "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\wra9f7\\hqhonebzzq6vve\\tnvqh.wav", "sha1_hash": "9ee6383f3e92cd745049320943b92e561e6b8d7a", "sha256_hash": "cae05315fcc1cdc50661b05daff39e3747ab024a6781abf2243405faf1a100aa", "size": 50736, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a7d6c597f67bedbce0b7d4843a274574e9f14ebe", "file_type": "modified_file", "id": "file_341", "md5_hash": "2dd61f65d7d549f0564ae374b7bdc10d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\desktop.ini", "sha1_hash": "a7d6c597f67bedbce0b7d4843a274574e9f14ebe", "sha256_hash": "4a5b08ec17f9054b0cbb823f51431fc0ee45bcd530e1ede13945052efce215af", "size": 1456, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/78a35bb209ef9c18c5ece7ab4a5ad5781af10778", "file_type": "modified_file", "id": "file_344", "md5_hash": "3effda9243388de22d1e73b186f14b2f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\desktop.lnk", "sha1_hash": "78a35bb209ef9c18c5ece7ab4a5ad5781af10778", "sha256_hash": "7bec962c747e54009967b6bd6455e40f6829ffa9a22ceccce2ba579de2653e83", "size": 1472, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4ad79b7925cafafd4a800e09153f86bedbfbe8a4", "file_type": "modified_file", "id": "file_346", "md5_hash": "e46c1d25aa5c77c12544f777a3ad0719", "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\downloads.lnk", "sha1_hash": "4ad79b7925cafafd4a800e09153f86bedbfbe8a4", "sha256_hash": "453a1c16eb3ae9f01e75204f4b3083732bd08300dc300d82c639ab28d2489c9a", "size": 1920, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/16c74278447505ba6d7f7015a7eb983f813f4c9a", "file_type": "modified_file", "id": "file_348", "md5_hash": "ac1a60a4a24598311023a14e20d6bbc2", "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\onedrive.lnk", "sha1_hash": "16c74278447505ba6d7f7015a7eb983f813f4c9a", "sha256_hash": "a19711d62c877ad3ad615a4fb309515593f5bb480949debdf070a8dd1158a4b2", "size": 2000, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/407b56722ef60f05c5edd7297278b223320f836e", "file_type": "modified_file", "id": "file_350", "md5_hash": "c502ca9fdbec3f60dc8b4a0f8c82f0c3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\bing.url", "sha1_hash": "407b56722ef60f05c5edd7297278b223320f836e", "sha256_hash": "e3b8f17d1280c97b6e041d95854da3772509c5a9883d7a9f1bcf3acc8bb279c9", "size": 1152, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4997f213a0a8f74565d3d4a6411ee74ed5d370d5", "file_type": "modified_file", "id": "file_353", "md5_hash": "8e72f402d6f32a2eb8b40ef2bf09d134", "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\desktop.ini", "sha1_hash": "4997f213a0a8f74565d3d4a6411ee74ed5d370d5", "sha256_hash": "4f7b953408cc9936a382ff90102cbc50db2625cab0d8d017a81caa4b8132ecb5", "size": 1360, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ab6991ca91766ffa6a1c1c85d373eb2ba58b687c", "file_type": "modified_file", "id": "file_355", "md5_hash": "e4dd0769eed2ff53c7a6d53383848aec", "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\links\\desktop.ini", "sha1_hash": "ab6991ca91766ffa6a1c1c85d373eb2ba58b687c", "sha256_hash": "72a735d2fd20e5eb2909a8a433c0e3155452df4ea83b7c9dc43775144053c7b5", "size": 1024, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a2efedfc9abdf934a0703583b1e602843e2ad95d", "file_type": "modified_file", "id": "file_358", "md5_hash": "d799fa9f1655f95dc9be3bd1830e630c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\chromesetup.exe", "sha1_hash": "a2efedfc9abdf934a0703583b1e602843e2ad95d", "sha256_hash": "a997604d3eba8e39c9f26b46448adcf9ca5ec53fcafb6328a733acaa3f069bf3", "size": 1131272, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c70b3c04a93e561b4cf463ac44d10923da75566f", "file_type": "modified_file", "id": "file_361", "md5_hash": "a366561c12c6f69711d3bb85e052fa7d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\desktop.ini", "sha1_hash": "c70b3c04a93e561b4cf463ac44d10923da75566f", "sha256_hash": "b1422698d4c21483ab1bd86344784727cad570b0b0b1eeaef1f221496e685910", "size": 1232, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3e0290cf998e9438a8fdc1d728853baf249855d5", "file_type": "modified_file", "id": "file_364", "md5_hash": "8ae6ba7e2cef64e1b83d905ef8a359d1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\5lfe4lx.pptx", "sha1_hash": "3e0290cf998e9438a8fdc1d728853baf249855d5", "sha256_hash": "3319a6208bce5f2ffb77ced09c10b7f946b6ca496ebc1f1ca383d1da45309173", "size": 92133, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fe0682c1a4d8d9f3a4e42ba6b9cbc3d8fc5e3d81", "file_type": "modified_file", "id": "file_367", "md5_hash": "bb2b28d3d9425e23ace84a09fac7df48", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\atcbua--7ps9_ex5yf.xlsx", "sha1_hash": "fe0682c1a4d8d9f3a4e42ba6b9cbc3d8fc5e3d81", "sha256_hash": "128d71c93597a29a31d5c6e0b34302de049a6b8946013e5a8eaf11dc0ebd6159", "size": 26440, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/179cf3e5b3ff62e80bfa8e04da3cbbfb36008987", "file_type": "modified_file", "id": "file_369", "md5_hash": "e0ca48aa6b416a728272cb8532669d77", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\blbtlle6nvl7pn1.ots", "sha1_hash": "179cf3e5b3ff62e80bfa8e04da3cbbfb36008987", "sha256_hash": "a205e4456ed8fc355a9c921561d0ba86572f7b2a97b437f56d28bb09fdcc1cdd", "size": 59783, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/860a7d33a834d69fcc947226d561d6ca7c1440bb", "file_type": "modified_file", "id": "file_371", "md5_hash": "7132d3a594fda47d039273bbc40dbffd", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini", "sha1_hash": "860a7d33a834d69fcc947226d561d6ca7c1440bb", "sha256_hash": "b9b2bd048b7ee2b23a488b39c36a49d1a453087428ae56f7f43624b1658624bc", "size": 1360, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9f7f60ae8a6b76f239c49538aa2861b54decd2e8", "file_type": "modified_file", "id": "file_373", "md5_hash": "d6c0aecc35c6752044fc0a3f358c4438", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\em9gxmq2lkv8zfra.docx", "sha1_hash": "9f7f60ae8a6b76f239c49538aa2861b54decd2e8", "sha256_hash": "629221550960a4923ccad59511006ceacc33207ff3ae1ad3a325b5b7491d1a7d", "size": 55424, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/39927f5aa90216eb773e0c6e75e302b758a972b8", "file_type": "modified_file", "id": "file_375", "md5_hash": "38829e481348405ceb8c56ea6afafcbc", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ihzco2.pptx", "sha1_hash": "39927f5aa90216eb773e0c6e75e302b758a972b8", "sha256_hash": "adaa6d74ea28423855e6e7692b6e3f8e017d8a8e927b9ac2a1267bf01db3f422", "size": 93272, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/875b442fdc757c1aa6aeb27a313e6fc39057745b", "file_type": "modified_file", "id": "file_377", "md5_hash": "bb3004b11d168b4a36362ab8dac001e3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\j0-1vw5m.xlsx", "sha1_hash": "875b442fdc757c1aa6aeb27a313e6fc39057745b", "sha256_hash": "928ba3e229fb49221ffc5776bef2dbeef69868e8e47cbdbd142a06ac1e622b66", "size": 40992, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5adbfab896b3022888b98fc88fba17090f2f3711", "file_type": "modified_file", "id": "file_379", "md5_hash": "bdd35099b5733ef0f88a0ef16d548022", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\k3dcza0zgh0l2.pptx", "sha1_hash": "5adbfab896b3022888b98fc88fba17090f2f3711", "sha256_hash": "aa91542cbf44a112c3ca34b229643b425702ac2fd7e393f38673b258ee01b17c", "size": 69696, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e05607a0e937a02d31306827ad5146115f0c08f1", "file_type": "modified_file", "id": "file_381", "md5_hash": "f62e0d8e2121eba5a7eba2c4295d5119", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\kfqf_.docx", "sha1_hash": "e05607a0e937a02d31306827ad5146115f0c08f1", "sha256_hash": "18395014b6110b19aa83fd46ebfcb68071f3b217135cce3a1369cb17e980845a", "size": 103120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/06a99fd7f41b10a48adeeab576bdb8f600b3f26c", "file_type": "modified_file", "id": "file_383", "md5_hash": "c313df2430b95bccf035b45e8b914d7c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\lmdzhf4zvs-.pps", "sha1_hash": "06a99fd7f41b10a48adeeab576bdb8f600b3f26c", "sha256_hash": "ab9a7e09e71451e51982810687069d152bc87cdf15a878a0f3e2bf715cd22491", "size": 71088, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b0ac972721872d2bdad0d08c5c42987ad6c54d5e", "file_type": "modified_file", "id": "file_385", "md5_hash": "271ee1a8f66413cc5cbdc13ee9a38eb3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\m_9esbnarkheuqxe.docx", "sha1_hash": "b0ac972721872d2bdad0d08c5c42987ad6c54d5e", "sha256_hash": "0007103666a7d2d5ad561fe7672a402e3057fdc335683721e9d41cc2c8f4d703", "size": 42297, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/364294d210db5d175c90bccc29115097075c7810", "file_type": "modified_file", "id": "file_387", "md5_hash": "4e89acc7705a2c247531cfb38cc959ad", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\n3kedft.pptx", "sha1_hash": "364294d210db5d175c90bccc29115097075c7810", "sha256_hash": "654f3b03bb659e77075ec644c0550db81dfe36b8c5b5dac184ac1aaff79b7468", "size": 48582, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/20e6954a2f3b7b21ccdd95abfba6253d4962ca80", "file_type": "modified_file", "id": "file_389", "md5_hash": "43a109cbad2a998a80bb3859c38d63e5", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\oev elnpibhwxetbc4x.doc", "sha1_hash": "20e6954a2f3b7b21ccdd95abfba6253d4962ca80", "sha256_hash": "97831cd49259321394e24360862bef0b4ed701f8f68bf17eaa16311fa28e0046", "size": 23984, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/16b0110bfec3748471ff0a9af02bc1e3feaa945a", "file_type": "modified_file", "id": "file_391", "md5_hash": "2adb27e44099ee6d25e57e76a8a47620", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ox bq4vkxjpjqad.xlsx", "sha1_hash": "16b0110bfec3748471ff0a9af02bc1e3feaa945a", "sha256_hash": "7c8c94ea900cb780b1e86f4f4c98123563be7ab7fdcdf3ba44917a1cf7df82e0", "size": 19648, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2125df9acfb366e05b4eac0df7544885b45e2055", "file_type": "modified_file", "id": "file_393", "md5_hash": "f4a581445f7aa9a08a908eb3435d3bc1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\t zqsdpu2iujxle-.pptx", "sha1_hash": "2125df9acfb366e05b4eac0df7544885b45e2055", "sha256_hash": "3e65b92de3ec19e33ba27854b4d525590f0783787d100e075a46fd0fe903584c", "size": 11326, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7d84cd164ca658ec1ffa8e0076a05e0d90834840", "file_type": "modified_file", "id": "file_395", "md5_hash": "5ed82021669a29cfaff651ff2eb994b7", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\t-k5sgwmj3 mpb9ky.pps", "sha1_hash": "7d84cd164ca658ec1ffa8e0076a05e0d90834840", "sha256_hash": "f399c4c10846ff3acee01c2f1245171d52644c60e3d36288fb23c194a4290c56", "size": 29587, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2f34d66c058d9695961bdff0b84bbe82f08a04d1", "file_type": "modified_file", "id": "file_397", "md5_hash": "c5f37bb31bf82d434c4f160447302c2f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\utm7gxl.docx", "sha1_hash": "2f34d66c058d9695961bdff0b84bbe82f08a04d1", "sha256_hash": "73f5a5be792c8bc6482290898c5650bb8b919d016a0d77c1fb8825e6a179805f", "size": 3200, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c13664a4c2005697da822c62e112cbdf606be53c", "file_type": "modified_file", "id": "file_399", "md5_hash": "0aadbe0252995e204ad2923b0f16f804", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\uwnmvsu.xlsx", "sha1_hash": "c13664a4c2005697da822c62e112cbdf606be53c", "sha256_hash": "c255a6b0b9b59d2ee5ba0049086a146cbb803feaa1ebb19c0da0c4d768d3e355", "size": 43452, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b3504351bcf95644560fb6e085fe6daec668d7af", "file_type": "modified_file", "id": "file_401", "md5_hash": "3cde757e4ac9b478f2008278635e5fa0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\v5i14i.docx", "sha1_hash": "b3504351bcf95644560fb6e085fe6daec668d7af", "sha256_hash": "9e3dbf4855f172b589e18a4199a4453238f4ca2a24e57c2ea3259b8eb5c3dc43", "size": 88704, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/801fdc717f4d616a34639ed2c53c6304313d39ce", "file_type": "modified_file", "id": "file_403", "md5_hash": "6238bb78be1339b9b84d1d7269bc154e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\vcavi.xlsx", "sha1_hash": "801fdc717f4d616a34639ed2c53c6304313d39ce", "sha256_hash": "5f57480f45195ff6f9b47fe359af826bbf874a773dc501c9680dea69016e1f3a", "size": 31395, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4bfe1825d7b1d75e7cdc9806eabd5e4b392b72ac", "file_type": "modified_file", "id": "file_405", "md5_hash": "0bde91f0221a2b4ad9a3b70bde3b8210", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\xci5tni.rtf", "sha1_hash": "4bfe1825d7b1d75e7cdc9806eabd5e4b392b72ac", "sha256_hash": "007070b5fc331849f1bd6e0a7db59103032bcd88b605469deaeb78da74cadc04", "size": 56576, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e0a22e6515fff108263aec290c8f0c0eca772fdb", "file_type": "modified_file", "id": "file_407", "md5_hash": "fef54df67c6fdf75b7060d5f49e2b8d3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\zyrasy.xlsx", "sha1_hash": "e0a22e6515fff108263aec290c8f0c0eca772fdb", "sha256_hash": "29843e2e80655534d29fb410f4a68e457e872d90f7b0ecb57869cb4581a3b89a", "size": 77830, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da0d71891879f9d1119585929f6a3e70d89cf327", "file_type": "modified_file", "id": "file_409", "md5_hash": "c9a73b53db9df683fd0ccddd73677e5c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\1oyb.pptx", "sha1_hash": "da0d71891879f9d1119585929f6a3e70d89cf327", "sha256_hash": "989136495493a8503b90b7bcabc84485d3bf28223aa3cbb0d8b21a124af376c2", "size": 73536, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f15fa83391c035ed7147af2d644933297b423dba", "file_type": "modified_file", "id": "file_412", "md5_hash": "80a43a0cd95e74917ab9b95c595aa51d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\5fs 9 uvpa.doc", "sha1_hash": "f15fa83391c035ed7147af2d644933297b423dba", "sha256_hash": "898e7ae080088de473abc7489ae11cbd154c1ab65299c331e5053cd0bbbfeb06", "size": 23552, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/768dd32ba36737944d5ace6bfb5af83707c56eab", "file_type": "modified_file", "id": "file_414", "md5_hash": "eddf88a74f8c1e38e81b2d39d0fb7287", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\l1ep-e2o7byfuic0.csv", "sha1_hash": "768dd32ba36737944d5ace6bfb5af83707c56eab", "sha256_hash": "40898d186753f8d7e6023c96570a22e1444f1a124f762f4c07ca2aa64b928e99", "size": 43516, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/585383376b2364edc3995107f438512f3884efca", "file_type": "modified_file", "id": "file_416", "md5_hash": "05a2747411805d61007a585241022ba1", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\qf 8oxk89nl1yrk6.rtf", "sha1_hash": "585383376b2364edc3995107f438512f3884efca", "sha256_hash": "6c3129a81a26f0d276a764ed3c7fbaace8ce847eded077b8516803c60e66052f", "size": 90304, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/00704182211c992a1248d141d56478cafa7132ff", "file_type": "modified_file", "id": "file_418", "md5_hash": "ed686da5f988824371258451d3ddb018", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\18wqha51.odp", "sha1_hash": "00704182211c992a1248d141d56478cafa7132ff", "sha256_hash": "019368379f17cc4936c49d82ce42e559cd289d8c6510f3da1543e20244290801", "size": 33442, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6b9c157cb058922272eb22c3c5602c1d94785b56", "file_type": "modified_file", "id": "file_421", "md5_hash": "c44fb790a903e179e9e7e99ab84bc1e8", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\d91n0zq.odp", "sha1_hash": "6b9c157cb058922272eb22c3c5602c1d94785b56", "sha256_hash": "aea9d1b73f8f83a8f2bb9c909c6033078ec0b5c189622f19df8d03ae341538e5", "size": 75325, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8a6973f5df8e4150a945138e774d8d12fbfc681f", "file_type": "modified_file", "id": "file_423", "md5_hash": "b2f5778eaa82936b9880b13b6cc13da3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\snyjwdmydf6ncuaoqltl.xls", "sha1_hash": "8a6973f5df8e4150a945138e774d8d12fbfc681f", "sha256_hash": "c733222b99882a60e133f39aef7cbef6374e93533ad12ef791f6dc558db83185", "size": 7120, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/21907f66018c1e00fbdeae8dbbbe08e8312e1128", "file_type": "modified_file", "id": "file_425", "md5_hash": "45eaac4bc88b05e200b38b08360ac8fa", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\wryiecxnl.ods", "sha1_hash": "21907f66018c1e00fbdeae8dbbbe08e8312e1128", "sha256_hash": "7e32f2864e64a33eb337e4bca656e4b81d6115d7e3984cf1cf70a78cb007c786", "size": 42698, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/35aeab669ec14f35f86cc273f380a4b618822039", "file_type": "modified_file", "id": "file_427", "md5_hash": "a099b07894d23f259de01bcd81532ab3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\xctuw.xlsx", "sha1_hash": "35aeab669ec14f35f86cc273f380a4b618822039", "sha256_hash": "a638b3b671899fc0c2a422c3f662045bdaaf1269138b1b16ffe4dad39a6eba8a", "size": 53248, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/72322e6a97eca15e148203c98b50e7d095a37f12", "file_type": "modified_file", "id": "file_429", "md5_hash": "ce5622667042406ce58a90565531f08b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\xie6iniolr04edgffg.odp", "sha1_hash": "72322e6a97eca15e148203c98b50e7d095a37f12", "sha256_hash": "60d63174500f7fab9f0922dc5f2a82091e05ee312f4d75e5aabffa5ad2640f80", "size": 83584, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2cce857577dcaa1d2fdae120468c3eb588ebd3c8", "file_type": "modified_file", "id": "file_431", "md5_hash": "5139f918139be5599211e4c712f07bdd", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\kfmszdl4nvsi2cz.docx", "sha1_hash": "2cce857577dcaa1d2fdae120468c3eb588ebd3c8", "sha256_hash": "5b4d1b02dae55d427fd7ecd2cb5df99d767fe36058c6b567e33994088a3ef535", "size": 70096, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4c3768d54fb47063f1c1755c70088160d0e244d9", "file_type": "modified_file", "id": "file_434", "md5_hash": "326f7cbebd98a3b18f99a43a7db7b05a", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\wgy2yqxdku.pdf", "sha1_hash": "4c3768d54fb47063f1c1755c70088160d0e244d9", "sha256_hash": "7f71b00cb45357d55d27f6d2b94aebfdfce3f35dee287a8adcddb17c5ffa02b8", "size": 34704, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9f4a43f439980be525e48c9fbff55fc7edabc093", "file_type": "modified_file", "id": "file_436", "md5_hash": "d5997333bcd42432169bfcaee29512f0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\wi8f0q5o.xls", "sha1_hash": "9f4a43f439980be525e48c9fbff55fc7edabc093", "sha256_hash": "bb2fe0b0822c2002b2ce57819b375c0f52cd68d7979d002272f227af7ae8b6dd", "size": 8640, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5b29d9da543911b9f24bd5d241b1d8c9a9bd80fa", "file_type": "modified_file", "id": "file_438", "md5_hash": "9de86a69a5cc92864320d842ac329aaf", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\x5iffemyr.odp", "sha1_hash": "5b29d9da543911b9f24bd5d241b1d8c9a9bd80fa", "sha256_hash": "ef0c4f7b3790b7af48fb54d9c088e8ad78ffff7a37de5d6deb49ec19b589016a", "size": 28543, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1df958b17a5b9763fb698187cafec716ab9b1d79", "file_type": "modified_file", "id": "file_440", "md5_hash": "128767fe14a9907085fd57f6c937cfc0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\xy sr4g.pptx", "sha1_hash": "1df958b17a5b9763fb698187cafec716ab9b1d79", "sha256_hash": "134129fe83705338601df589940d84ae9218a1a75fc2d0c578408ae9748acf64", "size": 86848, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/92ca8270f596b9429482882370e3c4253fe257eb", "file_type": "modified_file", "id": "file_442", "md5_hash": "b2749671c660f1646c5037ec51a8bf90", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\y1x8zqxci645d\\yb mn0zdv.pptx", "sha1_hash": "92ca8270f596b9429482882370e3c4253fe257eb", "sha256_hash": "7e14be90109155ea24e755540485f426e893954710baf6285b5eef9e63d992aa", "size": 96185, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c1fb7eafa9413c5aa69d844b7892796f8dd0b842", "file_type": "modified_file", "id": "file_444", "md5_hash": "d53936a9eec3f561e3ebfa9c778c4334", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\5walp3bl2rwl-yo.xls", "sha1_hash": "c1fb7eafa9413c5aa69d844b7892796f8dd0b842", "sha256_hash": "3bf122ad6abeb26c19b9333ce3411ba51ef96d24d141e8128a338de4056f0377", "size": 85888, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/40ba7d618b16398d69675848db8f3c9e374096d8", "file_type": "modified_file", "id": "file_447", "md5_hash": "955e310b305a7e8202364c651d7e75b8", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\oidz6lcgnvxgf5.csv", "sha1_hash": "40ba7d618b16398d69675848db8f3c9e374096d8", "sha256_hash": "e2a8916d0118c0fd8d54cedd715ab3af840515aad7a60473574cde18de86d475", "size": 42211, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1a6c72464834014a881501cd2dbc1f20e346a240", "file_type": "modified_file", "id": "file_449", "md5_hash": "3e51be8ba7c141dd85be275ce5cccbc3", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\opt7hcn-3pa.xls", "sha1_hash": "1a6c72464834014a881501cd2dbc1f20e346a240", "sha256_hash": "13ffcb9e9f4301353a8f50af6bf4af1778c1a07562de78044a4cc394802c10e5", "size": 24288, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4d59939d7abe3f0b9accde8a972a1dd8f7f9aa0e", "file_type": "modified_file", "id": "file_451", "md5_hash": "aeb0d0c152fd93185711103144ab979e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\psmh09ma0h6sf.ots", "sha1_hash": "4d59939d7abe3f0b9accde8a972a1dd8f7f9aa0e", "sha256_hash": "8a2ecaea0995acdefa73abf55121aa89cd6fde12362cda4928e57169714ec8fe", "size": 44093, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f232156e9c35549d716910003fb608ba57e44ed2", "file_type": "modified_file", "id": "file_453", "md5_hash": "41d2932154f84eaf3cab87bf7a31cfcb", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\st0nfhr7kld7u.doc", "sha1_hash": "f232156e9c35549d716910003fb608ba57e44ed2", "sha256_hash": "ccb1380350d1cf11b606f4fad048837386749aec598121b9710c4c3b2840568f", "size": 2576, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/62a2d45b559f9b7a60926a8a99f5633e12c48081", "file_type": "modified_file", "id": "file_455", "md5_hash": "f32acbff1d55d75ff859ac340b6514be", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\ud56yevtc_mgvyoy1e.pptx", "sha1_hash": "62a2d45b559f9b7a60926a8a99f5633e12c48081", "sha256_hash": "a5cac3c6ff0c64690a3b2239090494e30083a5b42f838f22f8390f38e6727e2b", "size": 26845, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6d0056a644b354efae9424f01dab3fa33355f9ab", "file_type": "modified_file", "id": "file_457", "md5_hash": "55c6a2205364cf393b393ce3fe80297c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\vatb.csv", "sha1_hash": "6d0056a644b354efae9424f01dab3fa33355f9ab", "sha256_hash": "1e53ab22d9ffb9afb5d3fc4935107c830caf2129bd7141be820c982e2e09ad8d", "size": 15953, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/40d49f0e6ae4a03c3e8f31d5505cf786932996a8", "file_type": "modified_file", "id": "file_459", "md5_hash": "e4ca725480de99538747656fb243f6a0", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\yfdwehymeqvc.rtf", "sha1_hash": "40d49f0e6ae4a03c3e8f31d5505cf786932996a8", "sha256_hash": "68e7cd45719d00a84ec4845337ab3f9fcfcec5386664c0d2426d907061bb53ca", "size": 46066, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/54c390f584ef73b4f678bee834c8ccea0bb1dbea", "file_type": "modified_file", "id": "file_461", "md5_hash": "ed3f754e5eca0ffa477f9b6e2ed592f9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\wcamw\\3qzjcog3a.ods", "sha1_hash": "54c390f584ef73b4f678bee834c8ccea0bb1dbea", "sha256_hash": "799f2ab2e477efd4b00f4a8c932f2f3d7ef50c86ed5a5f7a5750f3c5ad9d1b2c", "size": 18624, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2510608c7e28d38e78465b8c4a48d886b2ae3482", "file_type": "modified_file", "id": "file_464", "md5_hash": "c0ccae55766c814555f970daad435d74", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\ttwps\\pkpwidd38h0\\4ldoz2w50h\\wcamw\\hfvups2ina_-bdqv8.rtf", "sha1_hash": "2510608c7e28d38e78465b8c4a48d886b2ae3482", "sha256_hash": "e2ba19b9bb407881b43899599adb1368bae5d8f7f748fc95c14196731a0bde1d", "size": 87824, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5790d282e5fd089b445970b5715e31f15667ad03", "file_type": "modified_file", "id": "file_466", "md5_hash": "1e22fc77e5bc9612f67bf185dfc04a15", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst", "sha1_hash": "5790d282e5fd089b445970b5715e31f15667ad03", "sha256_hash": "05179a8e28d115d9421190660a0216a83e68ea9f1c07cade8af59e39d4194a65", "size": 272304, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7f9ead291dd9cb8ee524c82c4e30c3ae15d829b7", "file_type": "modified_file", "id": "file_469", "md5_hash": "9aa8a9f23804a3ec80fa871475dbfbdb", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2", "sha1_hash": "7f9ead291dd9cb8ee524c82c4e30c3ae15d829b7", "sha256_hash": "77b4c0d5077e25a7a3704e7f90b30af7bc246962689b4730457875e3ddcd0973", "size": 7136, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d7617d18bc4c5dfc5e3aa2e8d8261bbe0d756134", "file_type": "modified_file", "id": "file_472", "md5_hash": "a41e1e20c8bde5fea292e8b65d41986f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one", "sha1_hash": "d7617d18bc4c5dfc5e3aa2e8d8261bbe0d756134", "sha256_hash": "5c7795ed04090e95cd8e455955db8738e4a2124bbc17544de863e0899051698d", "size": 361080, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f8efb0bfbdbc55f85ac8c41a76888c1ffcb833c7", "file_type": "modified_file", "id": "file_474", "md5_hash": "b7ba30f52e6052a678f9b39e7f965d17", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\desktop.ini", "sha1_hash": "f8efb0bfbdbc55f85ac8c41a76888c1ffcb833c7", "sha256_hash": "4fb0d86f57dc9ce54ad774b2f8d42292f226f3af462a56b2a8ad6bb0dd670c53", "size": 1168, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/badf397a72453babf239c0267ad39e720bf46cee", "file_type": "modified_file", "id": "file_477", "md5_hash": "cda824c35f96337a7cb8425128ed2d4b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\favorites.vssx", "sha1_hash": "badf397a72453babf239c0267ad39e720bf46cee", "sha256_hash": "8d3a4ffc3876de9ca4403f6ea9d263f5a93ff83e83cb5c065909528f05756d2e", "size": 896, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5cfba21a4bc52a1fc56b8ce92cd554861da3aaa1", "file_type": "modified_file", "id": "file_478", "md5_hash": "41c4d389a921cbb64521e10a5078c10c", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico", "sha1_hash": "5cfba21a4bc52a1fc56b8ce92cd554861da3aaa1", "sha256_hash": "1a8c01876d88f34dbbe6d6594057c12893ef188f4cc1066f17876d3096639495", "size": 30870, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8326e7835c750b9f5db47e5d2a22f2b050e8a85b", "file_type": "modified_file", "id": "file_481", "md5_hash": "1b0174959cdf1c95e7302f7f642aab37", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\grki.docx", "sha1_hash": "8326e7835c750b9f5db47e5d2a22f2b050e8a85b", "sha256_hash": "62aae11d86e50f8dbcaf9093247519aa18272dafdadefc36b8d3d505bf7e27d8", "size": 53552, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/443ce008650116e5f5b2e46405f9012112a7d464", "file_type": "modified_file", "id": "file_484", "md5_hash": "85052940c01ef0d3c9c27f50d59a6baa", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\kt33n_.ppt", "sha1_hash": "443ce008650116e5f5b2e46405f9012112a7d464", "sha256_hash": "0d9ccdc0d2312b2fdd4acd1ab28f1d539aa6a799eb470984fb4c494d62fae004", "size": 10980, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bb17fdf10902f89c0e50402243b81c5725f9f202", "file_type": "modified_file", "id": "file_486", "md5_hash": "e0ad9b054b207ded2770a5b538452a0f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\ucq2jjz35.xlsx", "sha1_hash": "bb17fdf10902f89c0e50402243b81c5725f9f202", "sha256_hash": "67199ddf4dbd100f8a710b2ca6a95eb7fbca95e9bdbc37a8431bf3e34d71b3d3", "size": 86384, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1c0d13aac0f75b3bb076003af17e3d0d056bf25c", "file_type": "modified_file", "id": "file_488", "md5_hash": "4eaad822e259b13761f077f604889d85", "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\2xncn\\vvbl5czqczhto.pptx", "sha1_hash": "1c0d13aac0f75b3bb076003af17e3d0d056bf25c", "sha256_hash": "d2a6a09d8be9a40d4256ef12a37ffe01f5979ab403d6464058a38a4388e371be", "size": 51856, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7152dfea0d70b3bc0aae98d0117878b3bfb4e189", "file_type": "modified_file", "id": "file_490", "md5_hash": "1696b50b454109c22f7c62c0714fbb92", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\1ilkjyrgg.ots", "sha1_hash": "7152dfea0d70b3bc0aae98d0117878b3bfb4e189", "sha256_hash": "a762cb70e2691cca2658d174de64f6c2188bc17fe2a3fe7e1e989606aa5b17d5", "size": 47702, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3625354724d3a06c839371ed15d5f8af54be7078", "file_type": "modified_file", "id": "file_493", "md5_hash": "1049d6cfe5fcc37f7e557a255cec377d", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\23i5acjuyspml.m4a", "sha1_hash": "3625354724d3a06c839371ed15d5f8af54be7078", "sha256_hash": "790f1d58144a7dc5b4d191b921fcee9bc029dfaf79a368f6fcd7e3950982414d", "size": 80678, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/39d8ad9b912c520658a91b194d6ce7ccaf7b937c", "file_type": "modified_file", "id": "file_495", "md5_hash": "1a8c1766f2707c2f0973a80b3531f419", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\34vihcjptwsy126cu6r.jpg", "sha1_hash": "39d8ad9b912c520658a91b194d6ce7ccaf7b937c", "sha256_hash": "05b299956ca9ed1ccad20469151cde9c1e811cdaef4d01ac71f8e0fc830e885a", "size": 84496, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8422a1e0d87c962ea7138611920d7218bb68e29a", "file_type": "modified_file", "id": "file_497", "md5_hash": "0aadc6941fef5e387cee1db92622d22e", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\5aymmplf.mp3", "sha1_hash": "8422a1e0d87c962ea7138611920d7218bb68e29a", "sha256_hash": "9e6a6d4489b2489ff45ac6c29993382955159ed43c4ebf69f5fc00632376c183", "size": 75615, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/010b5042c14e40944d38329a95fe24793bbe3989", "file_type": "modified_file", "id": "file_499", "md5_hash": "28ba4169da6d69a97930ba2edd8c6ef2", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\7uelr6 ahnxhpqmpu.flv", "sha1_hash": "010b5042c14e40944d38329a95fe24793bbe3989", "sha256_hash": "29fc657349085667f690d1aa6b761fe060ff1765abc96f66f9e6e65bab12b1e1", "size": 9750, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/18dec2ee645b8558ff53f9a56a80d60b06d62fb2", "file_type": "modified_file", "id": "file_501", "md5_hash": "0a88f39f142d19070c62bb3853c9fb88", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\9j9hsv0agjq5p.mp4", "sha1_hash": "18dec2ee645b8558ff53f9a56a80d60b06d62fb2", "sha256_hash": "dd478094357324673e879840eb21a008ee218b69107c7c097d4621f4a96e5506", "size": 96403, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bbcf9e81f3a1ab303224edd160f1fe05682cbeb5", "file_type": "modified_file", "id": "file_503", "md5_hash": "263e21ad09c330f8518cc491c7000f95", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\af0cjnijiae7zpu.swf", "sha1_hash": "bbcf9e81f3a1ab303224edd160f1fe05682cbeb5", "sha256_hash": "d7426fd57e5734570dd1a6b424bdb25827ac84f0fe8376784a6ff877a90a13d6", "size": 3920, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5edba77834febc437f81c74a3d27ad01633153be", "file_type": "modified_file", "id": "file_505", "md5_hash": "7413754f9c6e16e9dfc044f6de3b6823", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\bwjej4q.gif", "sha1_hash": "5edba77834febc437f81c74a3d27ad01633153be", "sha256_hash": "ffc5b02b3b793cb97fa3ed455c0faf5829231dc62b3a284055ad53544ee19868", "size": 7168, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0b8d12fcd3c43aed1253a41eb901d2ae794be112", "file_type": "modified_file", "id": "file_507", "md5_hash": "bb7a682d9063e54fbc7c03db7a99ff4f", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cfrs5lie-afnl_qf.jpg", "sha1_hash": "0b8d12fcd3c43aed1253a41eb901d2ae794be112", "sha256_hash": "c4805b3ab365557436f3cafafe18685652e5849cd7f4f18a145f84b42d894087", "size": 14686, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ced769de411494a779b2b2343cd9f4b79680e3a9", "file_type": "modified_file", "id": "file_509", "md5_hash": "5cfbabe8dde1f2fd154410b802dd7b34", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cp_i6vwpeagucdb9vyn0.pdf", "sha1_hash": "ced769de411494a779b2b2343cd9f4b79680e3a9", "sha256_hash": "93999ffd16aafbc136d3e430b5bec7fc0a67f521b0bd5ae4ef00e6317d28f56e", "size": 63704, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/06e8d8c2ffba635b70c747c95c456e3cadf25f62", "file_type": "modified_file", "id": "file_511", "md5_hash": "353e22f480804d868ba20aa5ac199d8b", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\cr1v23mrj a0x.m4a", "sha1_hash": "06e8d8c2ffba635b70c747c95c456e3cadf25f62", "sha256_hash": "667d72304a80383477cc66d3cd1415043e689a10be09a88a652e2ab78b14f6c2", "size": 2256, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/af7733df345ddf40bce6ff8799b0ebbfd06c2e62", "file_type": "modified_file", "id": "file_513", "md5_hash": "1303831f18dffd4cf7f31ee7c7682dc9", "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini", "sha1_hash": "af7733df345ddf40bce6ff8799b0ebbfd06c2e62", "sha256_hash": "032970cd060cdf8c701de88534b813f7b69277ce8ae5be1f12f8363b387bcfe7", "size": 1232, "type": "extracted_file", "version": 1 } ], "process_dumps": [ { "archive_path": "process_dumps/process_00000001-region_00000001-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "filename": "process_00000001-region_00000001-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "id": "proc_dump_515", "md5_hash": "cb73ce16a8947b7a7b09512866094fb3", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "14616189db07b19949cd50bd809f439fb089d4e2", "sha256_hash": "eebe34f84bd6f1085ee19e986783cfdb1f3dd9efad06153aac5d344893488160", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000002-addr_0x000000c468480000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000001-region_00000002-addr_0x000000c468480000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_516", "md5_hash": "542195ea831e03d0ca96727ecf8661e0", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "99ab85b92f71e8dbb8c2855b0f9f2ce8c789aea8", "sha256_hash": "2b879d74b4afada818825df7c2903af555c81b3bc4fa7a51a8e4cefbc32dcfbc", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000004-addr_0x000000c4684c0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000004-addr_0x000000c4684c0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_517", "md5_hash": "328b646855752f4c42dde671363cb9d0", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "ebc26e7bdcacfc60262091e12c1e01ef2e5368c8", "sha256_hash": "ca06487d98e2ec03ff04d179c9c23f9a129639df69c602f5e8c3cf8cb93c3081", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000007-addr_0x000000c4685e0000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000007-addr_0x000000c4685e0000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_518", "md5_hash": "48f71d94b4497c07d29edd204ac73634", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d0dbc13258ce427f599ff96e8ae98b68a155fae5", "sha256_hash": "e4702b903d77ec0bacde716b1ba080868d45574a82d21bf7e39e560a416da654", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000010-addr_0x00007ff76ff3a000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000001-region_00000010-addr_0x00007ff76ff3a000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_519", "md5_hash": "01f38d3dd2e08c784213825c697b4598", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3ae625e1031aa76e983452f2b2bc54783eb7ba6e", "sha256_hash": "54abd5d7f5b037ca278368a21fd2c3e33e7a50173208fc6061b8c6cda561d23d", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000011-addr_0x00007ff76ff3e000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000011-addr_0x00007ff76ff3e000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_520", "md5_hash": "cdc9b7c95e73e173521fff6516eecc95", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5d45bb143587f204f7245e5e5e1433f5ef25a06d", "sha256_hash": "3d44d36e9c647f47aac85d096daf863bae57df4154e1a4a8d8132e6c9916f93b", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000153-addr_0x000000c4687c0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000153-addr_0x000000c4687c0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_521", "md5_hash": "c706b590bcfd4e99cea9e836c279b5a7", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f8054add319f27dbd0d63af9ad1e419f8560b3a3", "sha256_hash": "6bbfaf042b640dfe4048f15c570d80399fde33fb6d7055cfbc850e1b8f3298e7", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000231-addr_0x000000c468490000-size_0x0000000000007000-perm_rw.bin", "filename": "process_00000001-region_00000231-addr_0x000000c468490000-size_0x0000000000007000-perm_rw.bin", "id": "proc_dump_547", "md5_hash": "e6b3a365ff5569b7330819e8b79741f5", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "75d5ec0dfb61919097832648c22e39aee13af71c", "sha256_hash": "fd27187abd63aa3885dda84607b821a006d5b24f249dae29d91dd3be274bb1ec", "size": 28672, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000233-addr_0x000000c4686b0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000233-addr_0x000000c4686b0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_548", "md5_hash": "b49a0fca8306c010b7c26b3926a99b7a", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "248fe25ef336933f6b1cbc7e448b5b50543181e1", "sha256_hash": "846948d3b47d56bb2a112ebbf9970497a37b823c361f931439895e80de35ec92", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000235-addr_0x00007ff76ff3c000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000235-addr_0x00007ff76ff3c000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_549", "md5_hash": "678c45914724d466d1c0ad46b0917596", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4e0bba466333c7b10b58f2e567ab2524d5b55373", "sha256_hash": "8557260e05b3dae19558e842ab93357aa0691d323b75d13e2cbe8ff1790935e7", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000246-addr_0x000000c4687b0000-size_0x0000000000007000-perm_rw.bin", "filename": "process_00000001-region_00000246-addr_0x000000c4687b0000-size_0x0000000000007000-perm_rw.bin", "id": "proc_dump_550", "md5_hash": "e8a864184a4ae5f086a9cd60203f946a", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "98bd03bf419c12e99471a0db1654e97c44a8424f", "sha256_hash": "ae2ba9c53f79fe614d32e521653548ab241e1628ee80e505803c1d41bd62910c", "size": 28672, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000247-addr_0x000000c4689f0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000247-addr_0x000000c4689f0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_551", "md5_hash": "4c96ca6e84fbb437d3f8af088835ac02", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "eb2eaf63ba830db4c1ba8c9f083f577762a56966", "sha256_hash": "4b229bbb55c17e945ae0e40e26e11fa4e2d928c2118db7eb25b8d44b07fadac7", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000252-addr_0x000000c4688d0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000001-region_00000252-addr_0x000000c4688d0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_552", "md5_hash": "8f4a4b4f4164b296bbe013344ebbe2f9", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "cbf5f576bc3b172fb41e8f0a39bcaf6aa41343ff", "sha256_hash": "92e3895c70fdcc527f1b35eda4a4c52ab576c68bf6a95b992df776c5408a7ee7", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000253-addr_0x000000c4688e0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000001-region_00000253-addr_0x000000c4688e0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_553", "md5_hash": "baa095d0f424ded37169dccfabe2a48b", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "13de5554742b8bdbbac3f1dd140af759f9f055a4", "sha256_hash": "556d13cdbbe748d7480e2434b1f1d58ff20c3c4211c0491da0abbd118c4e58cc", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000260-addr_0x000000c4688f0000-size_0x0000000000070000-perm_rw.bin", "filename": "process_00000001-region_00000260-addr_0x000000c4688f0000-size_0x0000000000070000-perm_rw.bin", "id": "proc_dump_554", "md5_hash": "196a6d3ff32f06b6a462d6a72f04749e", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5654138faff2f784ee7a6f05224ad0a58636dc20", "sha256_hash": "849f7b16bed023723b7c3977c977221a7e01af6928209cb3916ef31ce1e7a561", "size": 458752, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000263-addr_0x000000c468950000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000263-addr_0x000000c468950000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_555", "md5_hash": "51b300f818ad25a2994cb22500e68928", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d9a811362de632bf02cad309172149509ebc433c", "sha256_hash": "06832648bc1daa76179140ca266ccdd5ff20c7721da3070da35dac2fce3a248a", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000265-addr_0x000000c46a460000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000265-addr_0x000000c46a460000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_556", "md5_hash": "2bcbd2c6fa38e58693f621bd7862f04d", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d5f1d90c22cbd2b904d16a39914a1f03d519b826", "sha256_hash": "7511a59308e6c2d3fd424870bf626ce95be4cb5298a6273870a512956d1b86dd", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000266-addr_0x00007ff76ff38000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000266-addr_0x00007ff76ff38000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_557", "md5_hash": "31db5dcda7dc7a040e3033fac0148844", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a725cb8c937bdcd67291f809f03f4e25eaa40821", "sha256_hash": "2b0a2d8f27dbc36ee96c1eb2a243697fc5ce42dfd3355b58eb00b7beb0a4d576", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000287-addr_0x000000c46a620000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000287-addr_0x000000c46a620000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_558", "md5_hash": "9e85f466cb2b351b0945aa9aa8a9e8d2", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b5c0bbcd42aa0875ad6eabe5bcbe364509bb8fd2", "sha256_hash": "5b0b40b4a09e186f5825708f981cdb1d6d52ae3a36456d79b164a6168c62c50c", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000288-addr_0x00007ff76ff36000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000288-addr_0x00007ff76ff36000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_559", "md5_hash": "feab8e0b769d42739f941addd9834cc7", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "18f178b03cb308288cae1a2096f2628225827508", "sha256_hash": "e46ecd5f08a18eb2dc56057077866a543d93aa80290b100eafeebb7b4d4d7280", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000293-addr_0x000000c46a720000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000293-addr_0x000000c46a720000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_560", "md5_hash": "d42a8b203bf81e2f059002ad6d360279", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d7233dc778eeebd3d707c6906a4feaf1bc073417", "sha256_hash": "c29364b8fb8334cfaa90b73bdb80b5fd2ce366ff1c60e28a7b82b269d121e485", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000294-addr_0x00007ff76ff34000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000294-addr_0x00007ff76ff34000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_561", "md5_hash": "af23514d2de7624ea1cfb9b80d9c5b3d", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "28339470d0522d7c50b4dead7c567d68c4b5807d", "sha256_hash": "4838f1d6f1a0681f77cc21fa8a8995656d253ba2243bb84ba0c677820c5a44f9", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000303-addr_0x000000c468960000-size_0x0000000000090000-perm_rw.bin", "filename": "process_00000001-region_00000303-addr_0x000000c468960000-size_0x0000000000090000-perm_rw.bin", "id": "proc_dump_562", "md5_hash": "d240ffa8b16ce427984221b2b8564f5d", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3d3fff0f83abcb164365a2d59b17af094cc69c0c", "sha256_hash": "4ecd0ed85ddd80e46b12f34c96258c40e5d297b3678c6627b8afb1671e1ca267", "size": 589824, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000304-addr_0x000000c468940000-size_0x0000000000007000-perm_rw.bin", "filename": "process_00000001-region_00000304-addr_0x000000c468940000-size_0x0000000000007000-perm_rw.bin", "id": "proc_dump_563", "md5_hash": "1c8852b3ff37a1e179355fde68cadf1f", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "573e9e28afb0e3b865b85f22d8723c2f8426d1b2", "sha256_hash": "6e1f32cdd8c6e8def3eb73391043870876e9b151cd694accb3fb42d494b44bce", "size": 28672, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000306-addr_0x000000c468930000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000306-addr_0x000000c468930000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_564", "md5_hash": "28f10ac6c38f9f5f424e63d41b297196", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "ce6b44a7263d299a0946be07aad0a4bdb19920da", "sha256_hash": "1d58d2524fa1b2458af5b8da770eabfdbe1cf9e1c7efa869b90a3bce2ac8dd53", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000307-addr_0x000000c46a820000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000307-addr_0x000000c46a820000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_565", "md5_hash": "8649a6d0e114a195b0b8686d858c4d71", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d0948ad8847bfe53a60de460736c5e52e41dbf26", "sha256_hash": "a2857935817e7f756275350fcecd8b8e728aa5c852a88eb64765e7a0635916fd", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000311-addr_0x000000c4689e0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000311-addr_0x000000c4689e0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_566", "md5_hash": "5a23d64d63b470e96fad393071b98f76", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e1ccd19b4ebfdc536198e9ab226c5cf857cb7e33", "sha256_hash": "a582b7bb3412247854909ecf968107a75f2d511d8aabcc427e8899e4a9616044", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000314-addr_0x000000c46a920000-size_0x0000000000180000-perm_rw.bin", "filename": "process_00000001-region_00000314-addr_0x000000c46a920000-size_0x0000000000180000-perm_rw.bin", "id": "proc_dump_567", "md5_hash": "d8c228ee934d5420a1b1c9d69c5ed301", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f83eacdd20f41d1d08f606537b285f136fcea7da", "sha256_hash": "63e8adcc3d22b16db7ca5c3713a048f8d20da75f97ec5d31bc4c2d86a6c9699c", "size": 1572864, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000315-addr_0x000000c46a920000-size_0x0000000000140000-perm_rw.bin", "filename": "process_00000001-region_00000315-addr_0x000000c46a920000-size_0x0000000000140000-perm_rw.bin", "id": "proc_dump_568", "md5_hash": "aa9a79f5d493768139d70f134065c2ab", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "57e171aa5a33024f9adee2007d75eb7811f78c1e", "sha256_hash": "94f949772fb65b5a89d807945c27985771aab4eee1c4a8e3c0652992c0e02130", "size": 1310720, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000316-addr_0x000000c46aa90000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000316-addr_0x000000c46aa90000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_569", "md5_hash": "59416faf58a1ec21e8b3fbc69b5bb084", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2b8af84d5f3496df6321fdf6c10aef2b114e4a1e", "sha256_hash": "0e4b9927ca44c43145f0be022d2578946faf55fc979d807718255feafe9b08cf", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000317-addr_0x000000c468960000-size_0x0000000000070000-perm_rw.bin", "filename": "process_00000001-region_00000317-addr_0x000000c468960000-size_0x0000000000070000-perm_rw.bin", "id": "proc_dump_570", "md5_hash": "196a6d3ff32f06b6a462d6a72f04749e", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5654138faff2f784ee7a6f05224ad0a58636dc20", "sha256_hash": "849f7b16bed023723b7c3977c977221a7e01af6928209cb3916ef31ce1e7a561", "size": 458752, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000318-addr_0x000000c46aaa0000-size_0x00000000001d0000-perm_rw.bin", "filename": "process_00000001-region_00000318-addr_0x000000c46aaa0000-size_0x00000000001d0000-perm_rw.bin", "id": "proc_dump_571", "md5_hash": "5a6140844676ab662405d5ced5e845f1", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "18889a747a4c310d5e51204ee8f11b200df8c6fb", "sha256_hash": "37cdbeab1479b1f906254e366688443de2045771339f7253a9b4df7ecd5cea0f", "size": 1900544, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000319-addr_0x000000c46a920000-size_0x0000000000130000-perm_rw.bin", "filename": "process_00000001-region_00000319-addr_0x000000c46a920000-size_0x0000000000130000-perm_rw.bin", "id": "proc_dump_572", "md5_hash": "fa1ab9e0d584610378b2a0efc2fcbd59", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5c444a03df3c77dc102f6443a9593ba9fd61e59c", "sha256_hash": "02f18108dfb6866e15f96251665c2541d4394e2d16b32fc9a02ffb37d3279958", "size": 1245184, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000320-addr_0x000000c46aa50000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000320-addr_0x000000c46aa50000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_573", "md5_hash": "ac059d9c3de2c38f8d183ebee5ccc0dd", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6a54c297ebf9cdeae212fb88298340aa8ca09f2c", "sha256_hash": "a3541b466ed11efd0574c2b06f5a0a1b55709ed26901916b843a36a681e55d96", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000322-addr_0x000000c46aa40000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000322-addr_0x000000c46aa40000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_574", "md5_hash": "8cefd0c303e6b212d5882a184e2347dc", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dbe0756869754e133923e5ed7a60bb1760e9693c", "sha256_hash": "7f4c9a22b6f6e5fb5d816de951e4dd63ab4cfef9634132dcfceb8db78109a7e6", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000323-addr_0x000000c46ac70000-size_0x0000000000400000-perm_rw.bin", "filename": "process_00000001-region_00000323-addr_0x000000c46ac70000-size_0x0000000000400000-perm_rw.bin", "id": "proc_dump_575", "md5_hash": "22ea302c66298e9dbda909cb496e2842", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9fbe0acf58ae3784f024dd8a51724e1d398fde9e", "sha256_hash": "c4054c7094ead0e54221fd3feb70edb6c1f853d44507053efb275ca57db8202b", "size": 4194304, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000325-addr_0x000000c4689c0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000325-addr_0x000000c4689c0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_576", "md5_hash": "9644b5f6ca1d25f36e948e6508ea18c9", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c8ac8a5391a3b70c4f47b075fd1b0f13166ef0d7", "sha256_hash": "6cbcd3c79facf845a0bf961025571025eb2be9af428721e81e7b1a4a691b8458", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000326-addr_0x000000c46aaa0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000326-addr_0x000000c46aaa0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_577", "md5_hash": "3fa9dde98cf01c76ff9f026784a753c0", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8ec4f89cf18d469aaf7193e5a98ca77b21b4b406", "sha256_hash": "69c0085964669e3c2c31b359b26da3282dd13f433d6a9ea1e3774d9a690a308d", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000327-addr_0x000000c46ac60000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000327-addr_0x000000c46ac60000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_578", "md5_hash": "ffef1465f41831721f17ccb2a9e8c7ee", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "97ac644dcbe984ed27ef9257f0bfb9b4324e81e3", "sha256_hash": "54c8dfdeefaf6296cbc1ce28fdfd5f7a4bda7ac67c21bfe5919681892b9ffe59", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000328-addr_0x000000c46b070000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000328-addr_0x000000c46b070000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_579", "md5_hash": "a0e2d70a6c59653452820b22ce2e36b1", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5d1cb547c693339f0f6ed0c5c1eabc3f456eacf6", "sha256_hash": "9432b7fd53705e63222d0c78e8a898fb82441d8a9410b4db593bb742b32aae49", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000329-addr_0x000000c46b170000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000329-addr_0x000000c46b170000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_580", "md5_hash": "0f349accf65b7f07a5767e12bf4b71e0", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e54f741d58883d2759f81f943f830f1e494d0bf0", "sha256_hash": "771c445cf83850f3cbb1ed0c056d44240e9742a4b9326453fece3e10045b1155", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000330-addr_0x00007ff76fe0a000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000330-addr_0x00007ff76fe0a000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_581", "md5_hash": "4d992bccb6fa5b942007ad434aa2736c", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "fff66b1e5b236f01a6f686d7a5ae86858221f4b1", "sha256_hash": "12875d306f8778113ea95be2b5a2ea57be96c68b09e183c88ec589a7dc3cd96b", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000331-addr_0x00007ff76fe0c000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000331-addr_0x00007ff76fe0c000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_582", "md5_hash": "9f7abaae805c6d79f5cc05d52c678873", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dbd6fa3e014da181fda2227daf589a6ade682075", "sha256_hash": "998c8a33ce6d12aba28812a31e445fae5dc49a5d85e967f1b44bd418ffc3f9a6", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000332-addr_0x00007ff76fe0e000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000332-addr_0x00007ff76fe0e000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_583", "md5_hash": "fd9941cee11750b35fdf045c06bb835a", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8a36f3aeb015e910e80de7f2cadcfb314d6503e6", "sha256_hash": "c93501ebe75dc1cdeaf726771e343e1865e8300433645dfa37402412ec33d8d0", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000345-addr_0x000000c468980000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000001-region_00000345-addr_0x000000c468980000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_584", "md5_hash": "19039e05bf3b22409e47bf9d71319a59", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "487dde8ae1f7eeab001897df244ccdd4fd385d67", "sha256_hash": "541a4cc5d36669c5951bdde2f0d6512d2e8b641702f6f41243901f800716991f", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000362-addr_0x000000c46b270000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000362-addr_0x000000c46b270000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_585", "md5_hash": "ec125db5993d17995db46e468d452e98", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c77b94ba19fd6d8b1931e3713207d0159383f8b4", "sha256_hash": "73c847ae1e05a358d279ac065a65c282dd230fd0f3a19459b302c589e0f566ef", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000363-addr_0x000000c46b370000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000363-addr_0x000000c46b370000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_586", "md5_hash": "0169df77fa9526181d97a4a490ce0972", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "085735674c86a3576b61e257b3bca84f27dfac03", "sha256_hash": "39807c4184416a2c38cb017095361c5ac94babec724c13b1462f922dee0d80b5", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000364-addr_0x00007ff76fe08000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000364-addr_0x00007ff76fe08000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_587", "md5_hash": "0f6a36f55eb60f1b78c72774008cb0cd", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e4f48984e3a16f2b230a6cbe0ad24751f84b5b5a", "sha256_hash": "487a1b27c449e2828031fddb61487af50f97715117c2b8cf216a803e26d20ea4", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000365-addr_0x000000c46b470000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000365-addr_0x000000c46b470000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_588", "md5_hash": "cefd5788e38173c348fe6e2c8bbec930", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f24a35fef78396cca116a338abd06c66286e60c1", "sha256_hash": "433226800fe48db0122862f736f93facbfa0fa9f9b54471181b8dad616d7d7b6", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000367-addr_0x000000c46b570000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000367-addr_0x000000c46b570000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_589", "md5_hash": "95ed26d369e5ba98060ef84592d85750", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "50c03e5794f695ac524c8efbc3b8c07d9440a53b", "sha256_hash": "ced06e46ee1282cbc49e7140d951c1ec9d55c2a44d9c165b16d2631043a62c53", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000368-addr_0x00007ff76fe06000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000368-addr_0x00007ff76fe06000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_590", "md5_hash": "36663934aa5bca214b9632d066e8f59d", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7268badb216d49ec7ddfe6cdd225babb223da450", "sha256_hash": "3381df4c331778363125178630f3cde4744cdf30cceba3118ac6d586ba629a9b", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000379-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "filename": "process_00000003-region_00000379-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "id": "proc_dump_591", "md5_hash": "64b4ce9ccb5afcc5b3ad68963191de33", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8deb904e235a0818c8e44e65f60e53da8cf7cbb0", "sha256_hash": "fc54ff566e241a468b2c4ed3982c8fbf1c26b93b053c243ff37f078210758762", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000380-addr_0x0000004bba090000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000003-region_00000380-addr_0x0000004bba090000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_592", "md5_hash": "1d252d63faebe12c5c4632817c9ffdff", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f5c52034341f838f9dc9ab1b6c09428a115703d5", "sha256_hash": "166dc95dcdbf5ed0c9c21266864d3a96b54add868acada46ba8c9f2492f28816", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000382-addr_0x0000004bba0d0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000382-addr_0x0000004bba0d0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_593", "md5_hash": "f5df4e81cbc8d87095128af1259b778a", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "482504f79cc1cfafd4d50f195450c0ec6cff87ea", "sha256_hash": "3b82e663919501878e9b735209c45d2488e013aa0a2d40313c723900cb30fc59", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000385-addr_0x0000004bba1f0000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000003-region_00000385-addr_0x0000004bba1f0000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_594", "md5_hash": "d5a412776649e51aaef4acfab0234c4f", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "15c4b603df4ca8d0211b81d8b83f423512fd0566", "sha256_hash": "d7dfd1c5b6093c59af145315d88c01c73df721519e67571e0b469e2bff4a9804", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000388-addr_0x00007ff6de3b8000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000388-addr_0x00007ff6de3b8000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_595", "md5_hash": "e55ed16b134ac17cd8857116ecd22dbd", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2e10dc0c4d0a7b82d9a1eda0e500fb5ff0011155", "sha256_hash": "e17a1ffb3a87cfd5295363018789d3a44048d173ad7bfdc6074aa40693043a44", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000389-addr_0x00007ff6de3be000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000003-region_00000389-addr_0x00007ff6de3be000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_596", "md5_hash": "40b19baf5ae15c2d184af9ad102a3312", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8eaaae3044786202d520bf40071e7c373564145d", "sha256_hash": "bae4cf93848a05bc8b29dc27306b53ba8547cdf9e86e1578b32a06b0c7b465a0", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000392-addr_0x0000004bba220000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000392-addr_0x0000004bba220000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_597", "md5_hash": "364bdb5d9480a9d758f9a5c8a66e6f95", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "171b64791b939844db2ffadd9cf182ae00d0725a", "sha256_hash": "b35b8ac01ed61e2237979ed330462f7218381ac03b3477943f0169d9770c0b4e", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000435-addr_0x0000004bba0a0000-size_0x0000000000007000-perm_rw.bin", "filename": "process_00000003-region_00000435-addr_0x0000004bba0a0000-size_0x0000000000007000-perm_rw.bin", "id": "proc_dump_611", "md5_hash": "4d2b73820e935727ba9d28fb86cd707c", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d2ba7622e447bce5b1739f3d551b38d97d88ac64", "sha256_hash": "ecb7fe674aeb21bf66f8b697496a8c004290f16310caca0958e323656f7cf093", "size": 28672, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000437-addr_0x0000004bba3e0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000437-addr_0x0000004bba3e0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_612", "md5_hash": "5ae449815c60015cba32f026e9611bac", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "fcf521f11391e98f221aecf5e82e4e9043e23838", "sha256_hash": "e5ceae6dbc0143afb5df80b2c8d1fcad69237a2a4bca30c193fa9b72f710573d", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000438-addr_0x0000004bba5f0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000003-region_00000438-addr_0x0000004bba5f0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_613", "md5_hash": "374f0fe00f7ff6859f81354335434725", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "eab641308bdd7ea6649e6bc4c1aa696fecef9efa", "sha256_hash": "ed53292b19e8c0f00ef0d6692c15d5ca1b3b8dc332553d6d8e17d22504732b0a", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000440-addr_0x00007ff6de3bc000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000003-region_00000440-addr_0x00007ff6de3bc000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_614", "md5_hash": "7ef66800109d0eb5709a30fbd6061d85", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "765acdc24979aeb403dba6ba9273f8bf7cad868a", "sha256_hash": "e1184143bc86c51d0527f6b3e41dd1d2eed27ea083ced437c1cbbb8410ebe2fc", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000442-addr_0x0000004bba200000-size_0x0000000000007000-perm_rw.bin", "filename": "process_00000003-region_00000442-addr_0x0000004bba200000-size_0x0000000000007000-perm_rw.bin", "id": "proc_dump_615", "md5_hash": "e1760403bc86f58076ffcbdbda20fff4", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3f921ce299f9474a58711c8a255649ee76e721a8", "sha256_hash": "773b9b200474edb5b4c9ff8ba0c79fdcc6efd350f23344c6f85b3feb9960978f", "size": 28672, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000445-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000005-region_00000445-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_616", "md5_hash": "a1fca7214cbdcca293cde358826bead9", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "71ad538442854d78e95702c9d61759e76b3f5a66", "sha256_hash": "8666826e9a3847043dafe1a0fac8dd95adf1c23a3063577b3a1110d924d54063", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000446-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000005-region_00000446-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_617", "md5_hash": "1c05ed57ffe10b306014fcd2aed190b1", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9132075275fa92734840617cef817fdd0e01f136", "sha256_hash": "b8277ad8418ad3d793101e71e519320192719ab57b465481f5281d1e23b7c814", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000448-addr_0x0000000000060000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00000448-addr_0x0000000000060000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_618", "md5_hash": "08224ae8bf0735c648992f6f5a353191", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a7a9affdb9d6292e4785affd1c144eb77d0d97f5", "sha256_hash": "ebdb75b20007860b2567bb5fc1fae2c429ddbc2011db8c92d99616faf586866a", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000449-addr_0x00000000000a0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00000449-addr_0x00000000000a0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_619", "md5_hash": "e8846196800a3fbb4ce581562e88b27f", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "375fdd65dbbb693df9b03cf3130ec8ba8d522959", "sha256_hash": "a3243639e0a07dcc9bce4bab50d12617041e12d578a34a37948b19fbd15d1be9", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000452-addr_0x0000000000400000-size_0x000000000003c000-perm_rwx.bin", "filename": "process_00000005-region_00000452-addr_0x0000000000400000-size_0x000000000003c000-perm_rwx.bin", "id": "proc_dump_620", "md5_hash": "791eb17e062e69a1dedf5e90e0d07936", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c61562806cd3c9e34a6d6161aae1e005e3a6e850", "sha256_hash": "7c56d6a9de369f6dbe24059a08ad7e40570bb0ad162a0e0f7b2fcb0fcc771781", "size": 39936, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000455-addr_0x000000007ffdb000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00000455-addr_0x000000007ffdb000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_621", "md5_hash": "1eb435258673e99f19aa5f2ef9db5c5f", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "664fab6df34ed6e6f51c5b08c4cc6d10aab2724c", "sha256_hash": "043201b22e3325212afe4eed1654ae1bae1d4e6f138f2faefc7769bcb0f1f17a", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000456-addr_0x000000007ffde000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000005-region_00000456-addr_0x000000007ffde000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_622", "md5_hash": "84834fbc804f41d111d7ebdb8d8f11c5", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3c8eb682ca66aa0a040aa930dbee85398132d6e8", "sha256_hash": "fce6199a721cd7bd2b7b4ea88874baa4cdace73ea672e1a03837a6fde205eeb7", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000457-addr_0x000000007ffdf000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000005-region_00000457-addr_0x000000007ffdf000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_623", "md5_hash": "d31c19e79816d68a7c8af6911d244927", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0e2de349c3a693c027d1d4a4efb224a7ee6451a7", "sha256_hash": "f71c9dc7d00cad1a1485e16d1e9335fa657776e5714540a7f466730d3f35d5d0", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000458-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "filename": "process_00000005-region_00000458-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "id": "proc_dump_624", "md5_hash": "119f77ab28c383d49a39261545f52e25", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "330649fc56fa7936866c549e238d2ffe8f73c6a8", "sha256_hash": "9670466071ba48d60cea73852d88b4318de9784197d7e6ed4d8567c070a77ddf", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000463-addr_0x00000000001c0000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000005-region_00000463-addr_0x00000000001c0000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_625", "md5_hash": "c4451778d01a8a34864887d8f044678c", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1686d2b0ec1eac6437b1798c46a08a87849914bc", "sha256_hash": "0cfd327df9472b47e68bf2741f2924ed22d6c9a748dfbd8cd7dc3b40eff2f5c1", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000464-addr_0x0000000000370000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000005-region_00000464-addr_0x0000000000370000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_626", "md5_hash": "aa7684c7c89661f42b207359da9991d8", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "25853ce981f0472bc93eef86c82ff1563ec4025a", "sha256_hash": "cc3c2c9f6224e78974de7a8aea0b7ee955fa121f118bafe5156d89d576664a20", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000468-addr_0x0000000000590000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00000468-addr_0x0000000000590000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_627", "md5_hash": "4886c4775b294d6ab2dac51f05f737ec", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d6b9ba4892f3d79d054bdd796a1fd249601fbc96", "sha256_hash": "7787a7380fa23ebb451838715b75f57652525f5edf5e79a10af9273ed25da32e", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000472-addr_0x0000000000020000-size_0x0000000000004000-perm_rw.bin", "filename": "process_00000005-region_00000472-addr_0x0000000000020000-size_0x0000000000004000-perm_rw.bin", "id": "proc_dump_628", "md5_hash": "8b34b4a241c3276a0d1d6fd3a3005a65", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "851c5f516d70efb6d70467260d4ddb51f5f59b23", "sha256_hash": "c2b809e12531efaa18b5913eb3edb6255a0d3db3e9fb6bc1ec73a94f5b8d3873", "size": 16384, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000474-addr_0x0000000000290000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00000474-addr_0x0000000000290000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_629", "md5_hash": "143f38021fb604043e7b31367ca862af", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3a80cf769dbdf80d4ea989514ed8e3b92596e3a0", "sha256_hash": "aa1e07cf6ca98c585098f1629265db5f79b794616824315a07d2e956561e0dbb", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000475-addr_0x0000000000440000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00000475-addr_0x0000000000440000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_630", "md5_hash": "47cddc07c6d3ab301720a02001ccc2f0", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7f1d14d0167f8e8d4ee484abec426e513c6c1094", "sha256_hash": "892ffae7443f10e1c3f0ae9511c7df8d7e2a512dbe8e6828ae31744ba2734769", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000496-addr_0x000000007ffd8000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00000496-addr_0x000000007ffd8000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_631", "md5_hash": "3ec040e29059da3566b99519d337fb50", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "26063cf4dc12a3dc289bc7d7da0f44827e69bd0a", "sha256_hash": "6661e15e82b81ae16875aae444368f12164d3eaf81e2e088bdf08dfbc5c286ea", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000497-addr_0x0000000000350000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000005-region_00000497-addr_0x0000000000350000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_632", "md5_hash": "ab3d0b0d5f9571cfcebba91edfb485dd", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "29e7fb7052e59159edca713e85c4cef99cf6deab", "sha256_hash": "ef47854be97375206115378018fd0c1a1868735d980da09a99a8488e812740f2", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000501-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000005-region_00000501-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_633", "md5_hash": "7477ed148b807f33a429c10f08a0959d", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f5b9a8e1091ce40c8211b1c8f5517ab3fa7b71b3", "sha256_hash": "c355631d1faa32422c9c68e579a2b32105886b38d1f1305462632e341cf42c56", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000502-addr_0x00000000002d0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000005-region_00000502-addr_0x00000000002d0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_634", "md5_hash": "620f0b67a91f7f74151bc5be745b7110", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d", "sha256_hash": "ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000507-addr_0x0000000001db0000-size_0x0000000000130000-perm_rw.bin", "filename": "process_00000005-region_00000507-addr_0x0000000001db0000-size_0x0000000000130000-perm_rw.bin", "id": "proc_dump_635", "md5_hash": "fa1ab9e0d584610378b2a0efc2fcbd59", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5c444a03df3c77dc102f6443a9593ba9fd61e59c", "sha256_hash": "02f18108dfb6866e15f96251665c2541d4394e2d16b32fc9a02ffb37d3279958", "size": 1245184, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000520-addr_0x0000000000300000-size_0x0000000000004000-perm_rw.bin", "filename": "process_00000005-region_00000520-addr_0x0000000000300000-size_0x0000000000004000-perm_rw.bin", "id": "proc_dump_636", "md5_hash": "18ad2de5c920a954bd455b4ee1e4763f", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9c1f75978650224e4e95ccc089b2ba2bb82d72a5", "sha256_hash": "5007dc362d035bf7bae0061f293d64e1ead8dfc5943db3c479f7bd302c7df29b", "size": 16384, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000524-addr_0x0000000000380000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00000524-addr_0x0000000000380000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_637", "md5_hash": "8d54a0132783825a18a90041cefe7e65", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3d7cbfb9150f6b284db68de35922bb1a0fd65786", "sha256_hash": "e380cf6efdcd6dee83aa5512c89ac38f0b0248a1a1342edc99e495829452c0bb", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000525-addr_0x0000000001db0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00000525-addr_0x0000000001db0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_638", "md5_hash": "ecf16ecf2767374ce24a6f1ea6304537", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "458e1dd60623c6c0d9dd40490d68da063b5c5bb2", "sha256_hash": "90e6f7bbf8516aaad8c375aff5184fb45c8af0eee1337d0a43dd4adf520b541a", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000526-addr_0x0000000001ed0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000005-region_00000526-addr_0x0000000001ed0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_639", "md5_hash": "918ac3fc53128eb4fb6356e0ddd032c7", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1767f7091b2bf911cbea052d1e9a4d679023b313", "sha256_hash": "5f59d4dedca105ce0e3785bcfb8029338efa9e3d67d9d858350ba797ce137e1b", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000527-addr_0x000000007ffd5000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00000527-addr_0x000000007ffd5000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_640", "md5_hash": "822b0233e53418a6ccf38e7fd1b305be", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bcc784f0b9b9f21d897511b97523b7eda2031557", "sha256_hash": "6cdd1c2a1de53da478dc9d5d183db97bb893b073dd891ee700f8c907b3a321cd", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000532-addr_0x0000000002220000-size_0x000000000080b000-perm_rw.bin", "filename": "process_00000005-region_00000532-addr_0x0000000002220000-size_0x000000000080b000-perm_rw.bin", "id": "proc_dump_641", "md5_hash": "ac625bd96bdffb24643c9ed82ac69969", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3efb195e1e7c97b255eb15694fc89ddebe433f56", "sha256_hash": "f5780f7f7da58d8e1d0c1a7228a6b81a6fcd34b634ec13189ad41dafe7b18acc", "size": 8433664, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000534-addr_0x0000000010000000-size_0x0000000000006000-perm_rwx.bin", "filename": "process_00000005-region_00000534-addr_0x0000000010000000-size_0x0000000000006000-perm_rwx.bin", "id": "proc_dump_642", "md5_hash": "1c5e70b6d09f8f65902f0417061916af", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4ad9e6f2a0a7e421f511f02d78514942bd3bbe4f", "sha256_hash": "0f4a2510ceb7d14edfc2cdf551ea49da1421c9090771c31580080b4dff39d0d7", "size": 11264, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000535-addr_0x0000000000540000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000005-region_00000535-addr_0x0000000000540000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_643", "md5_hash": "1d5a667588ee67b0250b1c22d237703b", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "93754bada12b6203955a9659070916ca9353d2ad", "sha256_hash": "dcfacb8aeee7b64440956284047168f04cf2b7b4d1ddb87615a7564107f07a9d", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000536-addr_0x0000000002a30000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000005-region_00000536-addr_0x0000000002a30000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_644", "md5_hash": "82e67779a3511f1898e4b46b6e7c4d56", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "29d47f8eecfe3e21bdfcb696cfecffac9e345acf", "sha256_hash": "d5a55a8e5b85e394a73415cc212d4466990f01611b5bfcafe03832c4d5d4d5af", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000537-addr_0x000000007fead000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000005-region_00000537-addr_0x000000007fead000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_645", "md5_hash": "25387a51c45dbd4907cb12f06965aff9", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4fbef55b8192a449498a523e70fc0d60f7e26f02", "sha256_hash": "b9e8640e47a3cdacbd2933d7ab407d24618ae0791280b67d2d93a0df9aa67c65", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000543-addr_0x0000000000340000-size_0x000000000000e000-perm_rw.bin", "filename": "process_00000005-region_00000543-addr_0x0000000000340000-size_0x000000000000e000-perm_rw.bin", "id": "proc_dump_646", "md5_hash": "08f7e51303694a68fa9ae146c0dec63d", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "084e380d9da2c5ac26233f3a366aea9d9151a990", "sha256_hash": "570fc0cd44177f816ac2e7a83ecca195e814ce29ebd03671f5d8a9fb967e3800", "size": 57344, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000562-addr_0x0000000008a90000-size_0x0000000000177000-perm_rw.bin", "filename": "process_00000005-region_00000562-addr_0x0000000008a90000-size_0x0000000000177000-perm_rw.bin", "id": "proc_dump_657", "md5_hash": "1d2b0c01f2aeceea4a9cfc16cca2c847", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6a0af672a2db0e081a138a23edbc97bd5d27b8b8", "sha256_hash": "05373dca42e920fbf6e60489c9ffc6131187af7a0ac8db82c66dbc6f05798aa3", "size": 1536000, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000005-region_00000563-addr_0x0000000008c10000-size_0x0000000000179000-perm_rw.bin", "filename": "process_00000005-region_00000563-addr_0x0000000008c10000-size_0x0000000000179000-perm_rw.bin", "id": "proc_dump_658", "md5_hash": "84bab8a180b813333ca41e49d9801f02", "ref_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "61ca3688c37eb6933793b16e82d4a48e4710ad3e", "sha256_hash": "3ce4ace9457b51adc6b276d5299bc5fc70646b7339c6e870cb5a31c7c23eec67", "size": 1544192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000544-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000006-region_00000544-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_647", "md5_hash": "806f8388e225773782703c3491530080", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "ecb1f128908751c96bb18f2205228e94dfa57bc9", "sha256_hash": "b6855d12a347111aab826a0827ac8463b87e114ce1ffd2f768fabbc572003c09", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000545-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000006-region_00000545-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_648", "md5_hash": "f4cc582c151dea1d3a3f3301fc567e9f", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "cf51874fb5b0a0aa5651f9f1f5f139671d1d3326", "sha256_hash": "8d9809cf4b47ee39d4c9f3cfb9898d4b2c00dc73717d903f944f8634797f7121", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000547-addr_0x0000000000060000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000006-region_00000547-addr_0x0000000000060000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_649", "md5_hash": "45407ff9511cd49a4f01adce5d9e04e2", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d3c7e91c53688735c6cca54193b84d4f738a3528", "sha256_hash": "16c5e5ce59e4c8c57839330cd8d7155b5520cd9e9513bcbab83e188b3c4f09be", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000548-addr_0x00000000000a0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000006-region_00000548-addr_0x00000000000a0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_650", "md5_hash": "0791c5f697fbc12eee31b3d4c798d915", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "370d4dccc982d1e9b14e2ace251971c8bba5f0ba", "sha256_hash": "91792257917002700a0d5ebb3c30be6b46da50cc959fed162ea8ee9352cd3286", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000551-addr_0x00000000001c0000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000006-region_00000551-addr_0x00000000001c0000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_651", "md5_hash": "5cdf01d778a4ec18d6f621ca118c50e6", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1076e919c4313ede45dc04e8daaad792a2518cc9", "sha256_hash": "1a1033d6ce9eb5f8cf8ebd1fcab88ceb379adccb0dcb2f920f04863cb6d6f98c", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000552-addr_0x0000000000400000-size_0x000000000003c000-perm_rwx.bin", "filename": "process_00000006-region_00000552-addr_0x0000000000400000-size_0x000000000003c000-perm_rwx.bin", "id": "proc_dump_652", "md5_hash": "16931ffff110381798f67cfc6bed6c3b", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "54dc7413067432ea3b2770552813629f5cff3622", "sha256_hash": "584a0c0a6249ca495516679359a92c32790a98ba13ac15e2831feea0b4886298", "size": 245760, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000555-addr_0x000000007ffdb000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000006-region_00000555-addr_0x000000007ffdb000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_653", "md5_hash": "ea5397e16c0d986e13fcbf1c0482fa15", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "34028a763323181f79dceeff75c5bdd6bd2b4a8a", "sha256_hash": "20db0d29a314fe85f6fa56c50417b0f786e490e5409786fc8f66d6167ef265a7", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000556-addr_0x000000007ffde000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000006-region_00000556-addr_0x000000007ffde000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_654", "md5_hash": "6f79e419566e0eedc6e7361626087f9a", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1ebe8c3833c97d2005d3050e9befa6295eebe3fa", "sha256_hash": "2e5ec1ce024d0639b4ae6473890b3fc4d4156c92853a16d9e39407fbb30475db", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000557-addr_0x000000007ffdf000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000006-region_00000557-addr_0x000000007ffdf000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_655", "md5_hash": "dbe6c49c55f265ac339d72e1f583680e", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "cb6140f3f83b2a2dbec9d9f86309ff69d71e1ee5", "sha256_hash": "e6d63be7c2f9ca0378122b8329fdb7b6f62959d8bb53a079d961eced0d0dd158", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000558-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "filename": "process_00000006-region_00000558-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "id": "proc_dump_656", "md5_hash": "9a3abde36dd98dfd32fd26433c54b329", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0f4dcc0583489f4f9cf16340cd0c8d3a36bb8cdf", "sha256_hash": "7afd1bab0ff738a75dcce82afa6d50181d6a85557820280db0999e231990367b", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000576-addr_0x0000000000390000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000006-region_00000576-addr_0x0000000000390000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_669", "md5_hash": "0bf474928f16db82ef81f8339be2ee6b", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9e16c2ab0bed109140a7c5a6cf6b7baa1186c6e9", "sha256_hash": "0d49c14f4d89be8b582a3b1356da84f2193952d1ffa2524be6f1d7ffe2061ced", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000579-addr_0x0000000000260000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000006-region_00000579-addr_0x0000000000260000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_670", "md5_hash": "8b7361a50e2d8773e94b9a57fad8f3d3", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "16a4257207787a6d56a0bb4387d905a20cb43063", "sha256_hash": "1bc004dbf0124f4e4c3668d7d351a58e540b24df679de2910f4375297ecb86bd", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000584-addr_0x0000000000020000-size_0x0000000000004000-perm_rw.bin", "filename": "process_00000006-region_00000584-addr_0x0000000000020000-size_0x0000000000004000-perm_rw.bin", "id": "proc_dump_673", "md5_hash": "16a3db7a1790c0bcfecaec6c3384ff1a", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d220e68bb0fdca155bce8b318839e0d5a147596d", "sha256_hash": "272b8e7779f49f9eca1094b1a77d3eb8ade5f6aa829600096dc917b36644ca37", "size": 16384, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000585-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000006-region_00000585-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_674", "md5_hash": "da9adb0edff6b1288bb306a461ced314", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7998f849a970a20fa4f1f914856f34aee7b77ad0", "sha256_hash": "b0497522164234977a6922b917cf9bc4d3b87a6ec589bd936c1b63b108f7479d", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000586-addr_0x00000000001d0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000006-region_00000586-addr_0x00000000001d0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_675", "md5_hash": "2b5ed12b4e1b8de2698192757a2e5036", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "03c29c5552442448705589e271b5e6efe07abab4", "sha256_hash": "a3f7f6e10c54eb9b7e9ca699867c0d919c26cb31b2cbdd7473a073c173c54ed4", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000587-addr_0x0000000000210000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000006-region_00000587-addr_0x0000000000210000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_676", "md5_hash": "620f0b67a91f7f74151bc5be745b7110", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d", "sha256_hash": "ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000589-addr_0x00000000004d0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000006-region_00000589-addr_0x00000000004d0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_677", "md5_hash": "dbad7f8cfcc36ef7c035e16c262809ca", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b39117a0fe66c070033c4feafda132f2a3b48c5e", "sha256_hash": "79261b622859bb301f890a30b600597ab468196c6640e586007f32e2bff09694", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000591-addr_0x0000000000810000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000006-region_00000591-addr_0x0000000000810000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_678", "md5_hash": "2061dd974da6a91cb65f938b0f2213cf", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9456c2a5b2d24ed3af0375938e29b3483e28fafe", "sha256_hash": "65f9c8dfc24feb82a259a120d135dd0e91caa0976fc33daa04f0406992ac56c1", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000616-addr_0x000000007ffd8000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000006-region_00000616-addr_0x000000007ffd8000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_679", "md5_hash": "dc7563a2b5dc003dec0877e598b92f05", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1bb000129989b0f150aaa0e609315bf71bc14f3a", "sha256_hash": "a88b7785d16895734d1b28cc3e516c3213358baf5c4f2ce7ae582c1ce52ec832", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000617-addr_0x0000000000220000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000006-region_00000617-addr_0x0000000000220000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_680", "md5_hash": "be383dcab9e75d34d921dcbd26f0b9d9", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dbac551bac83b2c89e178e6d2e5cdf9b7a0f5ebf", "sha256_hash": "3a0a02505ce0366684f66cfa2b102d7a0c6330bd713f27c3086eedb630df85fd", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000618-addr_0x0000000001db0000-size_0x00000000001a0000-perm_rw.bin", "filename": "process_00000006-region_00000618-addr_0x0000000001db0000-size_0x00000000001a0000-perm_rw.bin", "id": "proc_dump_681", "md5_hash": "7ccbdadf63fa64766a526553dfc8d3db", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0294f150f91be1b3fed9ef8a7cd104f1794b3c72", "sha256_hash": "e75dd2f88d5501fc20270fd734fe2b4ed7b97245cc8fb5725a40f6aa816aa771", "size": 1703936, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000624-addr_0x0000000000230000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000006-region_00000624-addr_0x0000000000230000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_682", "md5_hash": "4c40d726de5c4a1e5c19b8f61dcdf905", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d557b45d2b0f14ed87830892d04135165fa241a7", "sha256_hash": "57b514a1bef325376ddedd70b64a239135890e33193b4a482711a7256e7d3278", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000626-addr_0x0000000001db0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000006-region_00000626-addr_0x0000000001db0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_683", "md5_hash": "ee3d24df7b475e95a8e274b367442f12", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "801c534f90bff345d3d1d87085e5de8c9123725a", "sha256_hash": "db5bc96af22fac2e767e71911892a0fa6f8b7e6bcf598782a820a14aac8e4f9f", "size": 364544, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000627-addr_0x0000000001f40000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000006-region_00000627-addr_0x0000000001f40000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_684", "md5_hash": "b3f9c0390e354238844421484ece40b7", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7a9c940b41ec9a0a945e15b66d5dbf6e349a13dd", "sha256_hash": "0bd6bd9c6d41a0fcc0defbc637b56102f0ff4565df9b0f049aa885a534dcb776", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000628-addr_0x0000000000230000-size_0x0000000000016000-perm_rw.bin", "filename": "process_00000006-region_00000628-addr_0x0000000000230000-size_0x0000000000016000-perm_rw.bin", "id": "proc_dump_685", "md5_hash": "e41d58cf3babb40fd78dcc3d936a80fc", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "ca994523236896bb32507adddd6bf389a7d32c14", "sha256_hash": "a8572311906a9b19095ed378c83f69d5958f268480946c510272edb3a0d02770", "size": 90112, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000670-addr_0x0000000003490000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000006-region_00000670-addr_0x0000000003490000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_686", "md5_hash": "18f7a56fe419419677771d63a0eb60cc", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "32353ddac212111719810d2f0dc07316307e878f", "sha256_hash": "d17add977fab0e087dcbf3c37370b98d5a92794eb3f3d45e063e9aaae4a2a7a6", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000671-addr_0x0000000000b20000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000007-region_00000671-addr_0x0000000000b20000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_687", "md5_hash": "0e875a7191444d4ad59b14703ba29f0a", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0979ddddf60afed4412853b6f31affa71ecca2a4", "sha256_hash": "7fa25349dafda0a3fdca296166a7189a4c28b7f3938877338ff001b116733c9e", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000672-addr_0x0000000000b40000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000007-region_00000672-addr_0x0000000000b40000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_688", "md5_hash": "c7e745e1724749aa4dfcef06662caa84", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8c8f10065501d266ac65a379fb58694b4bbb5281", "sha256_hash": "0278e38c548ef053bf583392254f2260b9745a2d030e9cf568a5f7c4b4eb4a9e", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000674-addr_0x0000000000b70000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000674-addr_0x0000000000b70000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_689", "md5_hash": "bf4e2e58bb6b9f36fa9038bb74b39320", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6b841edda611394eb3c74ba19f2a2da671e90a47", "sha256_hash": "e498bb04c276238224777aba73da797266f42e0bdf48d25785f52b1af346fcd7", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000675-addr_0x0000000000bb0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000675-addr_0x0000000000bb0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_690", "md5_hash": "3798e4a55b649d805f61a69d566852d1", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4d9cd67285d59a421419f32fbe6b6646b0934172", "sha256_hash": "f69e6a2c22bee461b14f5438704e0839f9c80d8406aa1581d08dcde63b3a241b", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000678-addr_0x0000000000c10000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000007-region_00000678-addr_0x0000000000c10000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_691", "md5_hash": "25d393b623e801b885aa95b6b0993327", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1b5e77f9cd851914d5357fa3575cbc6bdc12749b", "sha256_hash": "4c2f77ec8cec8d352eb38fd6297ab111404b289a2b35092ba7d348835e3908dc", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000683-addr_0x000000007ec14000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000007-region_00000683-addr_0x000000007ec14000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_692", "md5_hash": "7c61b6dbbcdb29f47912f629954c49cb", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0299f9efbe6ca7a506c595f66921deddac4a680a", "sha256_hash": "5843bf66542ea11663be1d1dfa8d47554c24b88114cf7c11421e73c4477993fe", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000684-addr_0x000000007ec1c000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000007-region_00000684-addr_0x000000007ec1c000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_693", "md5_hash": "8ca07c3de4ca9ceeb0c84421ae741e2f", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2b8403fe36f6f7fa0528c6667a64f9730426ac07", "sha256_hash": "4b1a1119702bea6705b7cc170d10012d16818071fa845b5fbb9a9ea7150ff300", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000685-addr_0x000000007ec1f000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000007-region_00000685-addr_0x000000007ec1f000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_694", "md5_hash": "2e16a5d83936c034e8b29759647ea549", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "90290ce7aa7f4f586020d3923f478f3fc20afdac", "sha256_hash": "a0a896f1fd05ecc7aab2e388af8d9576ff6866ab0daeb39a5150681b65c07a66", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000686-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "filename": "process_00000007-region_00000686-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "id": "proc_dump_695", "md5_hash": "a5150f1ba9fd96e05f76cda3be5671d8", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bbe37a03f83ddaa7dada96aa16b4b7984e706e3b", "sha256_hash": "4551eb45fc835b28be2580b83bf799fd3be6deb6a7a31998d1b5547140056963", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000714-addr_0x0000000000d70000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000007-region_00000714-addr_0x0000000000d70000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_696", "md5_hash": "41e008ec1ff8814d7cc5163d6c19d7d2", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "775aa2bc269711641fe37118ce8e47c95b2b1742", "sha256_hash": "8c674798dc17bebe1dba54cc3a8f90be112d6762238e3a088c67b8fcaf09b6a7", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000717-addr_0x0000000000e80000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000007-region_00000717-addr_0x0000000000e80000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_697", "md5_hash": "e2a11746ecdd8c93ab9f741f74d36fae", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "75671ec588d9a3b09cbc519ed360477c1d176b1b", "sha256_hash": "48fe948701816833ada508f1ad02ddb867dd810e76a2b2ae3d0e4773e1827249", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000760-addr_0x0000000000b30000-size_0x0000000000004000-perm_rw.bin", "filename": "process_00000007-region_00000760-addr_0x0000000000b30000-size_0x0000000000004000-perm_rw.bin", "id": "proc_dump_712", "md5_hash": "4120ae9b1bf33f2a6a17f17f5efeba6f", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a6cb2f788e519cf788e19816d9ceffd653da31a0", "sha256_hash": "faa92dda216c2b7b1069fec0d595177b328119ff1842d3c43771cff6f5d94758", "size": 16384, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000763-addr_0x0000000000ce0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000763-addr_0x0000000000ce0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_713", "md5_hash": "2e02954d8d2958fb195e45fd9fc692b9", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "ab51b7f72c20efdfe924bf9d04ea231b06eb580e", "sha256_hash": "fd19dd22c88e2f72b35d9a7f91ea10dd21d4552c312ec3ddc4f8675df8f554b6", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000764-addr_0x0000000000d20000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000764-addr_0x0000000000d20000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_714", "md5_hash": "e5550cd901eddb74c6b88bf109c169df", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6cd131f58081153a4f94366584ea597bb3e26af6", "sha256_hash": "8256a5e11de224d07e0c08d9ca574a384873eb971da7ded4039d08686b3c2708", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000765-addr_0x0000000000d60000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000007-region_00000765-addr_0x0000000000d60000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_715", "md5_hash": "da9adb0edff6b1288bb306a461ced314", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7998f849a970a20fa4f1f914856f34aee7b77ad0", "sha256_hash": "b0497522164234977a6922b917cf9bc4d3b87a6ec589bd936c1b63b108f7479d", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000766-addr_0x0000000000d80000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000766-addr_0x0000000000d80000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_716", "md5_hash": "3872d32618007e08456b9bb73f9184c9", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1bd73ae0ed4a0c04e0b5cce4cd03883ed46bc303", "sha256_hash": "3c6cc6a553db8282b624608ca38a47f4b62c3d692c59b591b822b4befcdbc4eb", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000767-addr_0x0000000000dc0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000767-addr_0x0000000000dc0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_717", "md5_hash": "e921fa7ba92965934482a4de52636a38", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c299a79224e96f84444520c594598ae9b25d507c", "sha256_hash": "1b89e8b9d34d2342f51a8091d5cf7c3f18ad9ca539fee2712316c4771daaa102", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000768-addr_0x0000000000e00000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000007-region_00000768-addr_0x0000000000e00000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_718", "md5_hash": "620f0b67a91f7f74151bc5be745b7110", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d", "sha256_hash": "ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000770-addr_0x0000000001140000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000007-region_00000770-addr_0x0000000001140000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_719", "md5_hash": "ec2417c1818fe6d4bb7f42e4922f9820", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0ad8fbffdccac9e774e7dd34870623c15f91f6fa", "sha256_hash": "4d019321ef19419c8fc88c90167bd4f96d114767048501c47f60c16f62a39d7f", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000799-addr_0x000000007ec16000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000007-region_00000799-addr_0x000000007ec16000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_720", "md5_hash": "e668cd605dfecc86a65c76cd5aa2c0e5", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2661e505324c6e019f8e337cad3c009629f46f51", "sha256_hash": "c4abfa3367d3fbb17e3c72dd2c9341f378379bfc75db36e0b27f492875c92df8", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000800-addr_0x000000007ec19000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000007-region_00000800-addr_0x000000007ec19000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_721", "md5_hash": "7bb69aa13e668f05e4b53d5f0ff7432f", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "50425698e05107abb60e301a57e3a43cf9c98f1a", "sha256_hash": "00ce8ef01ab61957fb0ca45cc46c4ffd06957902e134fa7e829bb87f48caa766", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000801-addr_0x0000000000e10000-size_0x0000000000004000-perm_rw.bin", "filename": "process_00000007-region_00000801-addr_0x0000000000e10000-size_0x0000000000004000-perm_rw.bin", "id": "proc_dump_722", "md5_hash": "3535c7816b0d92a8fdd2e95b09f9d6f8", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1c5c29efab88704d2eb54e9633105f99418ec14e", "sha256_hash": "7063d88ddcc9913df643acc48b0f67551b5a746cc464711f047a9a411b053305", "size": 16384, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000811-addr_0x0000000000e40000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000811-addr_0x0000000000e40000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_723", "md5_hash": "94347be4f1e9462e0e7b960a65ca50f2", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e74e0ccb9144b50a01684049c89dbe796210204b", "sha256_hash": "5eac71fea42c8cc732af77da4c91453f7819c76e8ebef8fb2ba8ad89644b8d40", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000812-addr_0x0000000001230000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000812-addr_0x0000000001230000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_724", "md5_hash": "8ccd9382c6ada536e5429a00c460e4ba", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "873051d2c49bd738ff74a99b5e946a50db814ba5", "sha256_hash": "9acc42abfd132665b96b840725a1f636572c707d2222b4201ce4d5bfcd1639f2", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000813-addr_0x0000000001270000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000813-addr_0x0000000001270000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_725", "md5_hash": "e985697e968b650fcc9eb34a305d2f8b", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "62cd1de1b51e2798d8eafb40dce94b314407d54e", "sha256_hash": "9e6b882148adc1d26701ad37fc241df224f2e9a5d17f10d9076151291028dd38", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000814-addr_0x0000000006bc0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000814-addr_0x0000000006bc0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_726", "md5_hash": "d208206c4d4ad12b3f4bd5aaba02cebd", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "fee58059b98765823ed4d281abbeab0a2db22130", "sha256_hash": "b5d5c3518740f09fa7c3206294afe8fc87c04b616bcdb5433bdf00f4b5c667f2", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000815-addr_0x0000000006c00000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000815-addr_0x0000000006c00000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_727", "md5_hash": "6e42c522eaba26e0a6acb6e0256cdf9c", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "29c1b638d694ec1fb08165530d72f8a5fc829fd2", "sha256_hash": "f0fa5f51aabe19c5f8ebe184f366c221fecc2c0482ceb591f5bab1281c49b0c9", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000816-addr_0x0000000006c40000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000007-region_00000816-addr_0x0000000006c40000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_728", "md5_hash": "d63a8ca771bcb6fd4740f0b92a08d74a", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "409a8f887b68b0a7d666a48887559280320c77a0", "sha256_hash": "b38ae5057859709ed49e1b9bd93a0f5aec9fd85a5cb5aa95480d0ed4a6fd7380", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000820-addr_0x000000007eae7000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000007-region_00000820-addr_0x000000007eae7000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_729", "md5_hash": "4bbebdbc24f76460932528c34c264e3f", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7c5085267d5ce0f4a3ede608af8ae486e6114978", "sha256_hash": "a3e0b70616ebe70d5ce852e4de437cf85d00b256875f03a2e38d7a1bc293288a", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000821-addr_0x000000007eaea000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000007-region_00000821-addr_0x000000007eaea000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_730", "md5_hash": "979469f7b01df9e9ee02f9a9557e1ac6", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5de45a1a5f8b1472b456ff6cdf2a82a4184a272e", "sha256_hash": "24fd9ef2be1b339c78a14ded4fce53098a15a60de261bd7a8ffa72f27b339288", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000822-addr_0x000000007eaed000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000007-region_00000822-addr_0x000000007eaed000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_731", "md5_hash": "a04f0818fff57d85fe6c7fefdf6355b4", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "792ef0604668cd9996a10dfa1613caf3a5acffba", "sha256_hash": "9b17ed4639d77c720c0f7db8aaca12449829dd458377fa9a2217ffc535ccc003", "size": 12288, "type": "process_dump", "version": 1 } ], "processes": [ { "cmd_line": "\"C:\\Windows\\System32\\CScript.exe\" \"C:\\Users\\CIIHMN~1\\Desktop\\MSC000~1.VBS\" ", "filename": "c:\\windows\\system32\\cscript.exe", "id": "proc_1", "image_name": "cscript.exe", "monitor_reason": "analysis_target", "monitored_id": 1, "origin_monitor_id": 0, "ref_parent_process": null, "regions": [ { "dump": { "filename": "process_00000001-region_00000001-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable" ], "ref_process_dump": { "ref_id": "proc_dump_515", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_1", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:13.534", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000002-addr_0x000000c468480000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_516", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 843563139072, "type": "region", "version": 1 }, "end_va": 843563270143, "entry_point": 0, "filename": null, "id": "region_2", "name": "private_0x000000c468480000", "norm_filename": null, "region_type": "private_memory", "start_va": 843563139072, "timestamp": "00:00:13.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 843563270144, "type": "region", "version": 1 }, "end_va": 843563352063, "entry_point": 0, "filename": null, "id": "region_3", "name": "pagefile_0x000000c4684a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843563270144, "timestamp": "00:00:13.535", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000004-addr_0x000000c4684c0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_517", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843563401216, "type": "region", "version": 1 }, "end_va": 843564449791, "entry_point": 0, "filename": null, "id": "region_4", "name": "private_0x000000c4684c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843563401216, "timestamp": "00:00:13.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 843564449792, "type": "region", "version": 1 }, "end_va": 843564466175, "entry_point": 0, "filename": null, "id": "region_5", "name": "pagefile_0x000000c4685c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843564449792, "timestamp": "00:00:13.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 843564515328, "type": "region", "version": 1 }, "end_va": 843564519423, "entry_point": 0, "filename": null, "id": "region_6", "name": "pagefile_0x000000c4685d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843564515328, "timestamp": "00:00:13.535", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000007-addr_0x000000c4685e0000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_518", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 843564580864, "type": "region", "version": 1 }, "end_va": 843564589055, "entry_point": 0, "filename": null, "id": "region_7", "name": "private_0x000000c4685e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843564580864, "timestamp": "00:00:13.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495499108352, "type": "region", "version": 1 }, "end_va": 140694522363903, "entry_point": 0, "filename": null, "id": "region_8", "name": "pagefile_0x00007df5ff070000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495499108352, "timestamp": "00:00:13.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140700711714816, "type": "region", "version": 1 }, "end_va": 140700711858175, "entry_point": 0, "filename": null, "id": "region_9", "name": "pagefile_0x00007ff76ff10000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140700711714816, "timestamp": "00:00:13.535", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000010-addr_0x00007ff76ff3a000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_519", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 140700711886848, "type": "region", "version": 1 }, "end_va": 140700711890943, "entry_point": 0, "filename": null, "id": "region_10", "name": "private_0x00007ff76ff3a000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700711886848, "timestamp": "00:00:13.535", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000011-addr_0x00007ff76ff3e000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_520", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140700711903232, "type": "region", "version": 1 }, "end_va": 140700711911423, "entry_point": 0, "filename": null, "id": "region_11", "name": "private_0x00007ff76ff3e000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700711903232, "timestamp": "00:00:13.536", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 192512, "start_va": 140700728557568, "type": "region", "version": 1 }, "end_va": 140700728750079, "entry_point": 140700728557568, "filename": "\\Windows\\System32\\cscript.exe", "id": "region_12", "name": "cscript.exe", "norm_filename": "c:\\windows\\system32\\cscript.exe", "region_type": "memory_mapped_file", "start_va": 140700728557568, "timestamp": "00:00:13.536", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_13", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:00:13.638", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000153-addr_0x000000c4687c0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_521", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843566546944, "type": "region", "version": 1 }, "end_va": 843567595519, "entry_point": 0, "filename": null, "id": "region_153", "name": "private_0x000000c4687c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843566546944, "timestamp": "00:00:14.917", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140716994985984, "type": "region", "version": 1 }, "end_va": 140716996939775, "entry_point": 140716994985984, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_154", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140716994985984, "timestamp": "00:00:14.917", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717039419392, "type": "region", "version": 1 }, "end_va": 140717040127999, "entry_point": 140717039419392, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_155", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717039419392, "timestamp": "00:00:15.424", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 843563139072, "type": "region", "version": 1 }, "end_va": 843563204607, "entry_point": 0, "filename": null, "id": "region_230", "name": "pagefile_0x000000c468480000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843563139072, "timestamp": "00:00:18.256", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000231-addr_0x000000c468490000-size_0x0000000000007000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_547", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 28672, "start_va": 843563204608, "type": "region", "version": 1 }, "end_va": 843563233279, "entry_point": 0, "filename": null, "id": "region_231", "name": "private_0x000000c468490000", "norm_filename": null, "region_type": "private_memory", "start_va": 843563204608, "timestamp": "00:00:18.257", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 843564646400, "type": "region", "version": 1 }, "end_va": 843565424639, "entry_point": 843564646400, "filename": "\\Windows\\System32\\locale.nls", "id": "region_232", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 843564646400, "timestamp": "00:00:18.257", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000233-addr_0x000000c4686b0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_548", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843565432832, "type": "region", "version": 1 }, "end_va": 843566481407, "entry_point": 0, "filename": null, "id": "region_233", "name": "private_0x000000c4686b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843565432832, "timestamp": "00:00:18.257", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140700710666240, "type": "region", "version": 1 }, "end_va": 140700711714815, "entry_point": 0, "filename": null, "id": "region_234", "name": "pagefile_0x00007ff76fe10000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140700710666240, "timestamp": "00:00:18.257", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000235-addr_0x00007ff76ff3c000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_549", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140700711895040, "type": "region", "version": 1 }, "end_va": 140700711903231, "entry_point": 0, "filename": null, "id": "region_235", "name": "private_0x00007ff76ff3c000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700711895040, "timestamp": "00:00:18.257", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 140716844843008, "type": "region", "version": 1 }, "end_va": 140716844883967, "entry_point": 140716844843008, "filename": "\\Windows\\System32\\version.dll", "id": "region_236", "name": "version.dll", "norm_filename": "c:\\windows\\system32\\version.dll", "region_type": "memory_mapped_file", "start_va": 140716844843008, "timestamp": "00:00:18.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1204224, "start_va": 140717019627520, "type": "region", "version": 1 }, "end_va": 140717020831743, "entry_point": 140717019627520, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_237", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 140717019627520, "timestamp": "00:00:18.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 679936, "start_va": 140717023100928, "type": "region", "version": 1 }, "end_va": 140717023780863, "entry_point": 140717023100928, "filename": "\\Windows\\System32\\advapi32.dll", "id": "region_238", "name": "advapi32.dll", "norm_filename": "c:\\windows\\system32\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 140717023100928, "timestamp": "00:00:18.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1593344, "start_va": 140717024215040, "type": "region", "version": 1 }, "end_va": 140717025808383, "entry_point": 140717024215040, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_239", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 140717024215040, "timestamp": "00:00:18.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1368064, "start_va": 140717026770944, "type": "region", "version": 1 }, "end_va": 140717028139007, "entry_point": 140717026770944, "filename": "\\Windows\\System32\\user32.dll", "id": "region_240", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 140717026770944, "timestamp": "00:00:18.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 372736, "start_va": 140717029916672, "type": "region", "version": 1 }, "end_va": 140717030289407, "entry_point": 140717029916672, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_241", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 140717029916672, "timestamp": "00:00:18.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 140717030309888, "type": "region", "version": 1 }, "end_va": 140717031088127, "entry_point": 140717030309888, "filename": "\\Windows\\System32\\oleaut32.dll", "id": "region_242", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\system32\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 140717030309888, "timestamp": "00:00:18.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1314816, "start_va": 140717031817216, "type": "region", "version": 1 }, "end_va": 140717033132031, "entry_point": 140717031817216, "filename": "\\Windows\\System32\\ole32.dll", "id": "region_243", "name": "ole32.dll", "norm_filename": "c:\\windows\\system32\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 140717031817216, "timestamp": "00:00:18.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2605056, "start_va": 140717033193472, "type": "region", "version": 1 }, "end_va": 140717035798527, "entry_point": 140717033193472, "filename": "\\Windows\\System32\\combase.dll", "id": "region_244", "name": "combase.dll", "norm_filename": "c:\\windows\\system32\\combase.dll", "region_type": "memory_mapped_file", "start_va": 140717033193472, "timestamp": "00:00:18.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717035945984, "type": "region", "version": 1 }, "end_va": 140717036589055, "entry_point": 140717035945984, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_245", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717035945984, "timestamp": "00:00:18.258", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000246-addr_0x000000c4687b0000-size_0x0000000000007000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_550", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 28672, "start_va": 843566481408, "type": "region", "version": 1 }, "end_va": 843566510079, "entry_point": 0, "filename": null, "id": "region_246", "name": "private_0x000000c4687b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843566481408, "timestamp": "00:00:18.267", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000247-addr_0x000000c4689f0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_551", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 843568840704, "type": "region", "version": 1 }, "end_va": 843568906239, "entry_point": 0, "filename": null, "id": "region_247", "name": "private_0x000000c4689f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843568840704, "timestamp": "00:00:18.267", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 843568906240, "type": "region", "version": 1 }, "end_va": 843570511871, "entry_point": 0, "filename": null, "id": "region_248", "name": "pagefile_0x000000c468a00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843568906240, "timestamp": "00:00:18.267", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 140717022838784, "type": "region", "version": 1 }, "end_va": 140717023059967, "entry_point": 140717022838784, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_249", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 140717022838784, "timestamp": "00:00:18.267", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 140717037060096, "type": "region", "version": 1 }, "end_va": 140717038485503, "entry_point": 140717037060096, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_250", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 140717037060096, "timestamp": "00:00:18.267", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 843567595520, "type": "region", "version": 1 }, "end_va": 843567607807, "entry_point": 843567595520, "filename": "\\Windows\\System32\\en-US\\cscript.exe.mui", "id": "region_251", "name": "cscript.exe.mui", "norm_filename": "c:\\windows\\system32\\en-us\\cscript.exe.mui", "region_type": "memory_mapped_file", "start_va": 843567595520, "timestamp": "00:00:18.274", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000252-addr_0x000000c4688d0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_552", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 843567661056, "type": "region", "version": 1 }, "end_va": 843567665151, "entry_point": 0, "filename": null, "id": "region_252", "name": "private_0x000000c4688d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843567661056, "timestamp": "00:00:18.275", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000253-addr_0x000000c4688e0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_553", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 843567726592, "type": "region", "version": 1 }, "end_va": 843567730687, "entry_point": 0, "filename": null, "id": "region_253", "name": "private_0x000000c4688e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843567726592, "timestamp": "00:00:18.275", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 843570544640, "type": "region", "version": 1 }, "end_va": 843572121599, "entry_point": 0, "filename": null, "id": "region_254", "name": "pagefile_0x000000c468b90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843570544640, "timestamp": "00:00:18.275", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 843572183040, "type": "region", "version": 1 }, "end_va": 843593154559, "entry_point": 0, "filename": null, "id": "region_255", "name": "pagefile_0x000000c468d20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843572183040, "timestamp": "00:00:18.275", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 876544, "start_va": 843567792128, "type": "region", "version": 1 }, "end_va": 843568668671, "entry_point": 843567792128, "filename": "\\Windows\\System32\\rpcss.dll", "id": "region_256", "name": "rpcss.dll", "norm_filename": "c:\\windows\\system32\\rpcss.dll", "region_type": "memory_mapped_file", "start_va": 843567792128, "timestamp": "00:00:18.302", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 140716983844864, "type": "region", "version": 1 }, "end_va": 140716983906303, "entry_point": 140716983844864, "filename": "\\Windows\\System32\\kernel.appcore.dll", "id": "region_257", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\system32\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 140716983844864, "timestamp": "00:00:18.567", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 438272, "start_va": 140716981944320, "type": "region", "version": 1 }, "end_va": 140716982382591, "entry_point": 140716981944320, "filename": "\\Windows\\System32\\bcryptprimitives.dll", "id": "region_258", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\system32\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 140716981944320, "timestamp": "00:00:18.571", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 614400, "start_va": 140716959399936, "type": "region", "version": 1 }, "end_va": 140716960014335, "entry_point": 140716959399936, "filename": "\\Windows\\System32\\uxtheme.dll", "id": "region_259", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\system32\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 140716959399936, "timestamp": "00:00:18.576", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000260-addr_0x000000c4688f0000-size_0x0000000000070000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_554", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 458752, "start_va": 843567792128, "type": "region", "version": 1 }, "end_va": 843568250879, "entry_point": 0, "filename": null, "id": "region_260", "name": "private_0x000000c4688f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843567792128, "timestamp": "00:00:18.582", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 843593154560, "type": "region", "version": 1 }, "end_va": 843596525567, "entry_point": 843593154560, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_261", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 843593154560, "timestamp": "00:00:18.682", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 36864, "start_va": 843567792128, "type": "region", "version": 1 }, "end_va": 843567828991, "entry_point": 843567792128, "filename": "\\Windows\\System32\\cscript.exe", "id": "region_262", "name": "cscript.exe", "norm_filename": "c:\\windows\\system32\\cscript.exe", "region_type": "memory_mapped_file", "start_va": 843567792128, "timestamp": "00:00:18.684", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000263-addr_0x000000c468950000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_555", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 843568185344, "type": "region", "version": 1 }, "end_va": 843568250879, "entry_point": 0, "filename": null, "id": "region_263", "name": "private_0x000000c468950000", "norm_filename": null, "region_type": "private_memory", "start_va": 843568185344, "timestamp": "00:00:18.684", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 622592, "start_va": 140716982403072, "type": "region", "version": 1 }, "end_va": 140716983025663, "entry_point": 140716982403072, "filename": "\\Windows\\System32\\sxs.dll", "id": "region_264", "name": "sxs.dll", "norm_filename": "c:\\windows\\system32\\sxs.dll", "region_type": "memory_mapped_file", "start_va": 140716982403072, "timestamp": "00:00:18.686", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000265-addr_0x000000c46a460000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_556", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843596562432, "type": "region", "version": 1 }, "end_va": 843597611007, "entry_point": 0, "filename": null, "id": "region_265", "name": "private_0x000000c46a460000", "norm_filename": null, "region_type": "private_memory", "start_va": 843596562432, "timestamp": "00:00:18.776", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000266-addr_0x00007ff76ff38000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_557", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140700711878656, "type": "region", "version": 1 }, "end_va": 140700711886847, "entry_point": 0, "filename": null, "id": "region_266", "name": "private_0x00007ff76ff38000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700711878656, "timestamp": "00:00:18.776", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 843567857664, "type": "region", "version": 1 }, "end_va": 843567861759, "entry_point": 0, "filename": null, "id": "region_267", "name": "pagefile_0x000000c468900000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843567857664, "timestamp": "00:00:18.780", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 753664, "start_va": 843597611008, "type": "region", "version": 1 }, "end_va": 843598364671, "entry_point": 0, "filename": null, "id": "region_268", "name": "pagefile_0x000000c46a560000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843597611008, "timestamp": "00:00:18.780", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 843567857664, "type": "region", "version": 1 }, "end_va": 843567874047, "entry_point": 0, "filename": null, "id": "region_269", "name": "pagefile_0x000000c468900000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843567857664, "timestamp": "00:00:18.780", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 139264, "start_va": 140716952256512, "type": "region", "version": 1 }, "end_va": 140716952395775, "entry_point": 140716952256512, "filename": "\\Windows\\System32\\dwmapi.dll", "id": "region_270", "name": "dwmapi.dll", "norm_filename": "c:\\windows\\system32\\dwmapi.dll", "region_type": "memory_mapped_file", "start_va": 140716952256512, "timestamp": "00:00:18.781", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 843567923200, "type": "region", "version": 1 }, "end_va": 843567927295, "entry_point": 0, "filename": null, "id": "region_271", "name": "pagefile_0x000000c468910000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843567923200, "timestamp": "00:00:18.785", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 675840, "start_va": 140717031096320, "type": "region", "version": 1 }, "end_va": 140717031772159, "entry_point": 140717031096320, "filename": "\\Windows\\System32\\clbcatq.dll", "id": "region_272", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\system32\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 140717031096320, "timestamp": "00:00:18.785", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 843567988736, "type": "region", "version": 1 }, "end_va": 843567992831, "entry_point": 0, "filename": null, "id": "region_273", "name": "pagefile_0x000000c468920000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843567988736, "timestamp": "00:00:18.926", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 140716634931200, "type": "region", "version": 1 }, "end_va": 140716635529215, "entry_point": 140716634931200, "filename": "\\Windows\\System32\\vbscript.dll", "id": "region_274", "name": "vbscript.dll", "norm_filename": "c:\\windows\\system32\\vbscript.dll", "region_type": "memory_mapped_file", "start_va": 140716634931200, "timestamp": "00:00:18.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 65536, "start_va": 140716833112064, "type": "region", "version": 1 }, "end_va": 140716833177599, "entry_point": 140716833112064, "filename": "\\Windows\\System32\\amsi.dll", "id": "region_275", "name": "amsi.dll", "norm_filename": "c:\\windows\\system32\\amsi.dll", "region_type": "memory_mapped_file", "start_va": 140716833112064, "timestamp": "00:00:19.052", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 118784, "start_va": 140716832849920, "type": "region", "version": 1 }, "end_va": 140716832968703, "entry_point": 140716832849920, "filename": "\\Program Files\\Windows Defender\\MpOAV.dll", "id": "region_276", "name": "mpoav.dll", "norm_filename": "c:\\program files\\windows defender\\mpoav.dll", "region_type": "memory_mapped_file", "start_va": 140716832849920, "timestamp": "00:00:19.104", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 843568054272, "type": "region", "version": 1 }, "end_va": 843568062463, "entry_point": 0, "filename": null, "id": "region_277", "name": "pagefile_0x000000c468930000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843568054272, "timestamp": "00:00:19.156", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 65536, "start_va": 140716750274560, "type": "region", "version": 1 }, "end_va": 140716750340095, "entry_point": 140716750274560, "filename": "\\Windows\\System32\\wldp.dll", "id": "region_278", "name": "wldp.dll", "norm_filename": "c:\\windows\\system32\\wldp.dll", "region_type": "memory_mapped_file", "start_va": 140716750274560, "timestamp": "00:00:19.158", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1839104, "start_va": 140716993085440, "type": "region", "version": 1 }, "end_va": 140716994924543, "entry_point": 140716993085440, "filename": "\\Windows\\System32\\crypt32.dll", "id": "region_279", "name": "crypt32.dll", "norm_filename": "c:\\windows\\system32\\crypt32.dll", "region_type": "memory_mapped_file", "start_va": 140716993085440, "timestamp": "00:00:19.213", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 69632, "start_va": 140716983713792, "type": "region", "version": 1 }, "end_va": 140716983783423, "entry_point": 140716983713792, "filename": "\\Windows\\System32\\msasn1.dll", "id": "region_280", "name": "msasn1.dll", "norm_filename": "c:\\windows\\system32\\msasn1.dll", "region_type": "memory_mapped_file", "start_va": 140716983713792, "timestamp": "00:00:19.421", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 344064, "start_va": 140716991184896, "type": "region", "version": 1 }, "end_va": 140716991528959, "entry_point": 140716991184896, "filename": "\\Windows\\System32\\wintrust.dll", "id": "region_281", "name": "wintrust.dll", "norm_filename": "c:\\windows\\system32\\wintrust.dll", "region_type": "memory_mapped_file", "start_va": 140716991184896, "timestamp": "00:00:19.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 94208, "start_va": 140716976177152, "type": "region", "version": 1 }, "end_va": 140716976271359, "entry_point": 140716976177152, "filename": "\\Windows\\System32\\cryptsp.dll", "id": "region_282", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\system32\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 140716976177152, "timestamp": "00:00:19.688", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 163840, "start_va": 140716981747712, "type": "region", "version": 1 }, "end_va": 140716981911551, "entry_point": 140716981747712, "filename": "\\Windows\\System32\\bcrypt.dll", "id": "region_283", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\system32\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 140716981747712, "timestamp": "00:00:19.745", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 208896, "start_va": 140716972310528, "type": "region", "version": 1 }, "end_va": 140716972519423, "entry_point": 140716972310528, "filename": "\\Windows\\System32\\rsaenh.dll", "id": "region_284", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\system32\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 140716972310528, "timestamp": "00:00:19.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 140716977684480, "type": "region", "version": 1 }, "end_va": 140716977729535, "entry_point": 140716977684480, "filename": "\\Windows\\System32\\cryptbase.dll", "id": "region_285", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\system32\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 140716977684480, "timestamp": "00:00:19.870", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000287-addr_0x000000c46a620000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_558", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843598397440, "type": "region", "version": 1 }, "end_va": 843599446015, "entry_point": 0, "filename": null, "id": "region_287", "name": "private_0x000000c46a620000", "norm_filename": null, "region_type": "private_memory", "start_va": 843598397440, "timestamp": "00:00:19.894", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000288-addr_0x00007ff76ff36000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_559", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140700711870464, "type": "region", "version": 1 }, "end_va": 140700711878655, "entry_point": 0, "filename": null, "id": "region_288", "name": "private_0x00007ff76ff36000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700711870464, "timestamp": "00:00:19.894", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 140716832456704, "type": "region", "version": 1 }, "end_va": 140716832505855, "entry_point": 140716832456704, "filename": "\\Windows\\System32\\msisip.dll", "id": "region_289", "name": "msisip.dll", "norm_filename": "c:\\windows\\system32\\msisip.dll", "region_type": "memory_mapped_file", "start_va": 140716832456704, "timestamp": "00:00:19.897", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 454656, "start_va": 140717026312192, "type": "region", "version": 1 }, "end_va": 140717026766847, "entry_point": 140717026312192, "filename": "\\Windows\\System32\\coml2.dll", "id": "region_290", "name": "coml2.dll", "norm_filename": "c:\\windows\\system32\\coml2.dll", "region_type": "memory_mapped_file", "start_va": 140717026312192, "timestamp": "00:00:19.926", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16777216, "start_va": 843599446016, "type": "region", "version": 1 }, "end_va": 843616223231, "entry_point": 0, "filename": null, "id": "region_291", "name": "pagefile_0x000000c46a720000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843599446016, "timestamp": "00:00:20.015", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 843568119808, "type": "region", "version": 1 }, "end_va": 843568127999, "entry_point": 0, "filename": null, "id": "region_292", "name": "pagefile_0x000000c468940000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843568119808, "timestamp": "00:00:20.015", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000293-addr_0x000000c46a720000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_560", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843599446016, "type": "region", "version": 1 }, "end_va": 843600494591, "entry_point": 0, "filename": null, "id": "region_293", "name": "private_0x000000c46a720000", "norm_filename": null, "region_type": "private_memory", "start_va": 843599446016, "timestamp": "00:00:20.019", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000294-addr_0x00007ff76ff34000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_561", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140700711862272, "type": "region", "version": 1 }, "end_va": 140700711870463, "entry_point": 0, "filename": null, "id": "region_294", "name": "private_0x00007ff76ff34000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700711862272, "timestamp": "00:00:20.019", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 118784, "start_va": 140716800999424, "type": "region", "version": 1 }, "end_va": 140716801118207, "entry_point": 140716800999424, "filename": "\\Windows\\System32\\wshext.dll", "id": "region_295", "name": "wshext.dll", "norm_filename": "c:\\windows\\system32\\wshext.dll", "region_type": "memory_mapped_file", "start_va": 140716800999424, "timestamp": "00:00:20.019", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 22171648, "start_va": 140716997410816, "type": "region", "version": 1 }, "end_va": 140717019582463, "entry_point": 140716997410816, "filename": "\\Windows\\System32\\shell32.dll", "id": "region_296", "name": "shell32.dll", "norm_filename": "c:\\windows\\system32\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 140716997410816, "timestamp": "00:00:20.108", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 6455296, "start_va": 140716984369152, "type": "region", "version": 1 }, "end_va": 140716990824447, "entry_point": 140716984369152, "filename": "\\Windows\\System32\\windows.storage.dll", "id": "region_297", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\system32\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 140716984369152, "timestamp": "00:00:20.110", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 696320, "start_va": 140716634210304, "type": "region", "version": 1 }, "end_va": 140716634906623, "entry_point": 140716634210304, "filename": "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_0212ec7eba871e86\\comctl32.dll", "id": "region_298", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_0212ec7eba871e86\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 140716634210304, "timestamp": "00:00:20.115", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 331776, "start_va": 140716997017600, "type": "region", "version": 1 }, "end_va": 140716997349375, "entry_point": 140716997017600, "filename": "\\Windows\\System32\\shlwapi.dll", "id": "region_299", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\system32\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 140716997017600, "timestamp": "00:00:20.155", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 733184, "start_va": 140716992299008, "type": "region", "version": 1 }, "end_va": 140716993032191, "entry_point": 140716992299008, "filename": "\\Windows\\System32\\SHCore.dll", "id": "region_300", "name": "shcore.dll", "norm_filename": "c:\\windows\\system32\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 140716992299008, "timestamp": "00:00:20.157", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 303104, "start_va": 140716984041472, "type": "region", "version": 1 }, "end_va": 140716984344575, "entry_point": 140716984041472, "filename": "\\Windows\\System32\\powrprof.dll", "id": "region_301", "name": "powrprof.dll", "norm_filename": "c:\\windows\\system32\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 140716984041472, "timestamp": "00:00:20.158", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 140716983910400, "type": "region", "version": 1 }, "end_va": 140716983988223, "entry_point": 140716983910400, "filename": "\\Windows\\System32\\profapi.dll", "id": "region_302", "name": "profapi.dll", "norm_filename": "c:\\windows\\system32\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 140716983910400, "timestamp": "00:00:20.159", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000303-addr_0x000000c468960000-size_0x0000000000090000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_562", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 589824, "start_va": 843568250880, "type": "region", "version": 1 }, "end_va": 843568840703, "entry_point": 0, "filename": null, "id": "region_303", "name": "private_0x000000c468960000", "norm_filename": null, "region_type": "private_memory", "start_va": 843568250880, "timestamp": "00:00:20.175", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000304-addr_0x000000c468940000-size_0x0000000000007000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_563", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 28672, "start_va": 843568119808, "type": "region", "version": 1 }, "end_va": 843568148479, "entry_point": 0, "filename": null, "id": "region_304", "name": "private_0x000000c468940000", "norm_filename": null, "region_type": "private_memory", "start_va": 843568119808, "timestamp": "00:00:20.178", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 140716633882624, "type": "region", "version": 1 }, "end_va": 140716634161151, "entry_point": 140716633882624, "filename": "\\Windows\\System32\\scrobj.dll", "id": "region_305", "name": "scrobj.dll", "norm_filename": "c:\\windows\\system32\\scrobj.dll", "region_type": "memory_mapped_file", "start_va": 140716633882624, "timestamp": "00:00:20.190", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000306-addr_0x000000c468930000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_564", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 843568054272, "type": "region", "version": 1 }, "end_va": 843568119807, "entry_point": 0, "filename": null, "id": "region_306", "name": "private_0x000000c468930000", "norm_filename": null, "region_type": "private_memory", "start_va": 843568054272, "timestamp": "00:00:20.276", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000307-addr_0x000000c46a820000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_565", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843600494592, "type": "region", "version": 1 }, "end_va": 843601543167, "entry_point": 0, "filename": null, "id": "region_307", "name": "private_0x000000c46a820000", "norm_filename": null, "region_type": "private_memory", "start_va": 843600494592, "timestamp": "00:00:20.280", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 892928, "start_va": 140716613959680, "type": "region", "version": 1 }, "end_va": 140716614852607, "entry_point": 140716613959680, "filename": "\\Program Files\\Windows Defender\\MpClient.dll", "id": "region_308", "name": "mpclient.dll", "norm_filename": "c:\\program files\\windows defender\\mpclient.dll", "region_type": "memory_mapped_file", "start_va": 140716613959680, "timestamp": "00:00:20.298", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 126976, "start_va": 140716973293568, "type": "region", "version": 1 }, "end_va": 140716973420543, "entry_point": 140716973293568, "filename": "\\Windows\\System32\\userenv.dll", "id": "region_309", "name": "userenv.dll", "norm_filename": "c:\\windows\\system32\\userenv.dll", "region_type": "memory_mapped_file", "start_va": 140716973293568, "timestamp": "00:00:20.407", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 843568250880, "type": "region", "version": 1 }, "end_va": 843568259071, "entry_point": 843568250880, "filename": "\\Program Files\\Windows Defender\\MsMpLics.dll", "id": "region_310", "name": "msmplics.dll", "norm_filename": "c:\\program files\\windows defender\\msmplics.dll", "region_type": "memory_mapped_file", "start_va": 843568250880, "timestamp": "00:00:20.502", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000311-addr_0x000000c4689e0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_566", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 843568775168, "type": "region", "version": 1 }, "end_va": 843568840703, "entry_point": 0, "filename": null, "id": "region_311", "name": "private_0x000000c4689e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843568775168, "timestamp": "00:00:20.506", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 143360, "start_va": 140716966019072, "type": "region", "version": 1 }, "end_va": 140716966162431, "entry_point": 140716966019072, "filename": "\\Windows\\System32\\gpapi.dll", "id": "region_312", "name": "gpapi.dll", "norm_filename": "c:\\windows\\system32\\gpapi.dll", "region_type": "memory_mapped_file", "start_va": 140716966019072, "timestamp": "00:00:20.512", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2322432, "start_va": 140716611600384, "type": "region", "version": 1 }, "end_va": 140716613922815, "entry_point": 140716611600384, "filename": "\\Windows\\System32\\msxml3.dll", "id": "region_313", "name": "msxml3.dll", "norm_filename": "c:\\windows\\system32\\msxml3.dll", "region_type": "memory_mapped_file", "start_va": 140716611600384, "timestamp": "00:00:20.623", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000314-addr_0x000000c46a920000-size_0x0000000000180000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_567", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1572864, "start_va": 843601543168, "type": "region", "version": 1 }, "end_va": 843603116031, "entry_point": 0, "filename": null, "id": "region_314", "name": "private_0x000000c46a920000", "norm_filename": null, "region_type": "private_memory", "start_va": 843601543168, "timestamp": "00:00:20.730", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000315-addr_0x000000c46a920000-size_0x0000000000140000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_568", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1310720, "start_va": 843601543168, "type": "region", "version": 1 }, "end_va": 843602853887, "entry_point": 0, "filename": null, "id": "region_315", "name": "private_0x000000c46a920000", "norm_filename": null, "region_type": "private_memory", "start_va": 843601543168, "timestamp": "00:00:20.732", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000316-addr_0x000000c46aa90000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_569", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 843603050496, "type": "region", "version": 1 }, "end_va": 843603116031, "entry_point": 0, "filename": null, "id": "region_316", "name": "private_0x000000c46aa90000", "norm_filename": null, "region_type": "private_memory", "start_va": 843603050496, "timestamp": "00:00:20.732", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000317-addr_0x000000c468960000-size_0x0000000000070000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_570", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 458752, "start_va": 843568250880, "type": "region", "version": 1 }, "end_va": 843568709631, "entry_point": 0, "filename": null, "id": "region_317", "name": "private_0x000000c468960000", "norm_filename": null, "region_type": "private_memory", "start_va": 843568250880, "timestamp": "00:00:20.733", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000318-addr_0x000000c46aaa0000-size_0x00000000001d0000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_571", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1900544, "start_va": 843603116032, "type": "region", "version": 1 }, "end_va": 843605016575, "entry_point": 0, "filename": null, "id": "region_318", "name": "private_0x000000c46aaa0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843603116032, "timestamp": "00:00:20.734", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000319-addr_0x000000c46a920000-size_0x0000000000130000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_572", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1245184, "start_va": 843601543168, "type": "region", "version": 1 }, "end_va": 843602788351, "entry_point": 0, "filename": null, "id": "region_319", "name": "private_0x000000c46a920000", "norm_filename": null, "region_type": "private_memory", "start_va": 843601543168, "timestamp": "00:00:20.735", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000320-addr_0x000000c46aa50000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_573", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 843602788352, "type": "region", "version": 1 }, "end_va": 843602853887, "entry_point": 0, "filename": null, "id": "region_320", "name": "private_0x000000c46aa50000", "norm_filename": null, "region_type": "private_memory", "start_va": 843602788352, "timestamp": "00:00:20.735", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 843601543168, "type": "region", "version": 1 }, "end_va": 843602456575, "entry_point": 843601543168, "filename": "\\Windows\\System32\\en-US\\KernelBase.dll.mui", "id": "region_321", "name": "kernelbase.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\kernelbase.dll.mui", "region_type": "memory_mapped_file", "start_va": 843601543168, "timestamp": "00:00:20.738", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000322-addr_0x000000c46aa40000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_574", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 843602722816, "type": "region", "version": 1 }, "end_va": 843602788351, "entry_point": 0, "filename": null, "id": "region_322", "name": "private_0x000000c46aa40000", "norm_filename": null, "region_type": "private_memory", "start_va": 843602722816, "timestamp": "00:00:20.742", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000323-addr_0x000000c46ac70000-size_0x0000000000400000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_575", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4194304, "start_va": 843605016576, "type": "region", "version": 1 }, "end_va": 843609210879, "entry_point": 0, "filename": null, "id": "region_323", "name": "private_0x000000c46ac70000", "norm_filename": null, "region_type": "private_memory", "start_va": 843605016576, "timestamp": "00:00:20.744", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 843568250880, "type": "region", "version": 1 }, "end_va": 843568254975, "entry_point": 843568250880, "filename": "\\Windows\\System32\\msxml3r.dll", "id": "region_324", "name": "msxml3r.dll", "norm_filename": "c:\\windows\\system32\\msxml3r.dll", "region_type": "memory_mapped_file", "start_va": 843568250880, "timestamp": "00:00:20.746", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000325-addr_0x000000c4689c0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_576", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 843568644096, "type": "region", "version": 1 }, "end_va": 843568709631, "entry_point": 0, "filename": null, "id": "region_325", "name": "private_0x000000c4689c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843568644096, "timestamp": "00:00:20.750", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000326-addr_0x000000c46aaa0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_577", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843603116032, "type": "region", "version": 1 }, "end_va": 843604164607, "entry_point": 0, "filename": null, "id": "region_326", "name": "private_0x000000c46aaa0000", "norm_filename": null, "region_type": "private_memory", "start_va": 843603116032, "timestamp": "00:00:20.762", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000327-addr_0x000000c46ac60000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_578", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 843604951040, "type": "region", "version": 1 }, "end_va": 843605016575, "entry_point": 0, "filename": null, "id": "region_327", "name": "private_0x000000c46ac60000", "norm_filename": null, "region_type": "private_memory", "start_va": 843604951040, "timestamp": "00:00:20.763", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000328-addr_0x000000c46b070000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_579", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843609210880, "type": "region", "version": 1 }, "end_va": 843610259455, "entry_point": 0, "filename": null, "id": "region_328", "name": "private_0x000000c46b070000", "norm_filename": null, "region_type": "private_memory", "start_va": 843609210880, "timestamp": "00:00:20.763", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000329-addr_0x000000c46b170000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_580", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843610259456, "type": "region", "version": 1 }, "end_va": 843611308031, "entry_point": 0, "filename": null, "id": "region_329", "name": "private_0x000000c46b170000", "norm_filename": null, "region_type": "private_memory", "start_va": 843610259456, "timestamp": "00:00:20.763", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000330-addr_0x00007ff76fe0a000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_581", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140700710641664, "type": "region", "version": 1 }, "end_va": 140700710649855, "entry_point": 0, "filename": null, "id": "region_330", "name": "private_0x00007ff76fe0a000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700710641664, "timestamp": "00:00:20.764", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000331-addr_0x00007ff76fe0c000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_582", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140700710649856, "type": "region", "version": 1 }, "end_va": 140700710658047, "entry_point": 0, "filename": null, "id": "region_331", "name": "private_0x00007ff76fe0c000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700710649856, "timestamp": "00:00:20.764", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000332-addr_0x00007ff76fe0e000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_583", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140700710658048, "type": "region", "version": 1 }, "end_va": 140700710666239, "entry_point": 0, "filename": null, "id": "region_332", "name": "private_0x00007ff76fe0e000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700710658048, "timestamp": "00:00:20.764", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1273856, "start_va": 140716610289664, "type": "region", "version": 1 }, "end_va": 140716611563519, "entry_point": 140716610289664, "filename": "\\Program Files\\Common Files\\System\\ado\\msado15.dll", "id": "region_333", "name": "msado15.dll", "norm_filename": "c:\\program files\\common files\\system\\ado\\msado15.dll", "region_type": "memory_mapped_file", "start_va": 140716610289664, "timestamp": "00:00:20.781", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 151552, "start_va": 140716650004480, "type": "region", "version": 1 }, "end_va": 140716650156031, "entry_point": 140716650004480, "filename": "\\Windows\\System32\\msdart.dll", "id": "region_334", "name": "msdart.dll", "norm_filename": "c:\\windows\\system32\\msdart.dll", "region_type": "memory_mapped_file", "start_va": 140716650004480, "timestamp": "00:00:20.871", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 167936, "start_va": 140716638142464, "type": "region", "version": 1 }, "end_va": 140716638310399, "entry_point": 140716638142464, "filename": "\\Windows\\System32\\wshom.ocx", "id": "region_335", "name": "wshom.ocx", "norm_filename": "c:\\windows\\system32\\wshom.ocx", "region_type": "memory_mapped_file", "start_va": 140716638142464, "timestamp": "00:00:20.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 114688, "start_va": 140716969230336, "type": "region", "version": 1 }, "end_va": 140716969345023, "entry_point": 140716969230336, "filename": "\\Windows\\System32\\mpr.dll", "id": "region_336", "name": "mpr.dll", "norm_filename": "c:\\windows\\system32\\mpr.dll", "region_type": "memory_mapped_file", "start_va": 140716969230336, "timestamp": "00:00:21.037", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 217088, "start_va": 140716632309760, "type": "region", "version": 1 }, "end_va": 140716632526847, "entry_point": 140716632309760, "filename": "\\Windows\\System32\\scrrun.dll", "id": "region_337", "name": "scrrun.dll", "norm_filename": "c:\\windows\\system32\\scrrun.dll", "region_type": "memory_mapped_file", "start_va": 140716632309760, "timestamp": "00:00:21.095", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 843568316416, "type": "region", "version": 1 }, "end_va": 843568381951, "entry_point": 843568316416, "filename": "\\Windows\\System32\\scrrun.dll", "id": "region_338", "name": "scrrun.dll", "norm_filename": "c:\\windows\\system32\\scrrun.dll", "region_type": "memory_mapped_file", "start_va": 843568316416, "timestamp": "00:00:21.197", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1667072, "start_va": 140716796084224, "type": "region", "version": 1 }, "end_va": 140716797751295, "entry_point": 140716796084224, "filename": "\\Windows\\System32\\urlmon.dll", "id": "region_339", "name": "urlmon.dll", "norm_filename": "c:\\windows\\system32\\urlmon.dll", "region_type": "memory_mapped_file", "start_va": 140716796084224, "timestamp": "00:00:21.206", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 3629056, "start_va": 140716846743552, "type": "region", "version": 1 }, "end_va": 140716850372607, "entry_point": 140716846743552, "filename": "\\Windows\\System32\\iertutil.dll", "id": "region_340", "name": "iertutil.dll", "norm_filename": "c:\\windows\\system32\\iertutil.dll", "region_type": "memory_mapped_file", "start_va": 140716846743552, "timestamp": "00:00:21.487", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2781184, "start_va": 140716791169024, "type": "region", "version": 1 }, "end_va": 140716793950207, "entry_point": 140716791169024, "filename": "\\Windows\\System32\\wininet.dll", "id": "region_341", "name": "wininet.dll", "norm_filename": "c:\\windows\\system32\\wininet.dll", "region_type": "memory_mapped_file", "start_va": 140716791169024, "timestamp": "00:00:21.492", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 249856, "start_va": 140716652167168, "type": "region", "version": 1 }, "end_va": 140716652417023, "entry_point": 140716652167168, "filename": "\\Windows\\System32\\mlang.dll", "id": "region_342", "name": "mlang.dll", "norm_filename": "c:\\windows\\system32\\mlang.dll", "region_type": "memory_mapped_file", "start_va": 140716652167168, "timestamp": "00:00:21.715", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 180224, "start_va": 140716979650560, "type": "region", "version": 1 }, "end_va": 140716979830783, "entry_point": 140716979650560, "filename": "\\Windows\\System32\\sspicli.dll", "id": "region_343", "name": "sspicli.dll", "norm_filename": "c:\\windows\\system32\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 140716979650560, "timestamp": "00:00:21.888", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 843568316416, "type": "region", "version": 1 }, "end_va": 843568320511, "entry_point": 0, "filename": null, "id": "region_344", "name": "pagefile_0x000000c468970000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843568316416, "timestamp": "00:00:21.975", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000345-addr_0x000000c468980000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_584", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 843568381952, "type": "region", "version": 1 }, "end_va": 843568386047, "entry_point": 843568381952, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat", "id": "region_345", "name": "counters.dat", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat", "region_type": "memory_mapped_file", "start_va": 843568381952, "timestamp": "00:00:21.979", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 430080, "start_va": 140717025853440, "type": "region", "version": 1 }, "end_va": 140717026283519, "entry_point": 140717025853440, "filename": "\\Windows\\System32\\ws2_32.dll", "id": "region_346", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\system32\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 140717025853440, "timestamp": "00:00:21.983", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 140716996952064, "type": "region", "version": 1 }, "end_va": 140716996984831, "entry_point": 140716996952064, "filename": "\\Windows\\System32\\nsi.dll", "id": "region_347", "name": "nsi.dll", "norm_filename": "c:\\windows\\system32\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 140716996952064, "timestamp": "00:00:22.144", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 86016, "start_va": 140716798377984, "type": "region", "version": 1 }, "end_va": 140716798463999, "entry_point": 140716798377984, "filename": "\\Windows\\System32\\OnDemandConnRouteHelper.dll", "id": "region_348", "name": "ondemandconnroutehelper.dll", "norm_filename": "c:\\windows\\system32\\ondemandconnroutehelper.dll", "region_type": "memory_mapped_file", "start_va": 140716798377984, "timestamp": "00:00:22.163", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 140716940394496, "type": "region", "version": 1 }, "end_va": 140716940439551, "entry_point": 140716940394496, "filename": "\\Windows\\System32\\winnsi.dll", "id": "region_349", "name": "winnsi.dll", "norm_filename": "c:\\windows\\system32\\winnsi.dll", "region_type": "memory_mapped_file", "start_va": 140716940394496, "timestamp": "00:00:22.224", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 229376, "start_va": 140716940525568, "type": "region", "version": 1 }, "end_va": 140716940754943, "entry_point": 140716940525568, "filename": "\\Windows\\System32\\IPHLPAPI.DLL", "id": "region_350", "name": "iphlpapi.dll", "norm_filename": "c:\\windows\\system32\\iphlpapi.dll", "region_type": "memory_mapped_file", "start_va": 140716940525568, "timestamp": "00:00:22.225", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 876544, "start_va": 140716873285632, "type": "region", "version": 1 }, "end_va": 140716874162175, "entry_point": 140716873285632, "filename": "\\Windows\\System32\\winhttp.dll", "id": "region_351", "name": "winhttp.dll", "norm_filename": "c:\\windows\\system32\\winhttp.dll", "region_type": "memory_mapped_file", "start_va": 140716873285632, "timestamp": "00:00:22.228", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 380928, "start_va": 140716975783936, "type": "region", "version": 1 }, "end_va": 140716976164863, "entry_point": 140716975783936, "filename": "\\Windows\\System32\\mswsock.dll", "id": "region_352", "name": "mswsock.dll", "norm_filename": "c:\\windows\\system32\\mswsock.dll", "region_type": "memory_mapped_file", "start_va": 140716975783936, "timestamp": "00:00:22.357", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 843568447488, "type": "region", "version": 1 }, "end_va": 843568451583, "entry_point": 0, "filename": null, "id": "region_353", "name": "pagefile_0x000000c468990000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843568447488, "timestamp": "00:00:22.364", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 688128, "start_va": 140716973686784, "type": "region", "version": 1 }, "end_va": 140716974374911, "entry_point": 140716973686784, "filename": "\\Windows\\System32\\dnsapi.dll", "id": "region_354", "name": "dnsapi.dll", "norm_filename": "c:\\windows\\system32\\dnsapi.dll", "region_type": "memory_mapped_file", "start_va": 140716973686784, "timestamp": "00:00:22.369", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 843568513024, "type": "region", "version": 1 }, "end_va": 843568578559, "entry_point": 0, "filename": null, "id": "region_355", "name": "pagefile_0x000000c4689a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843568513024, "timestamp": "00:00:22.509", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 140716828000256, "type": "region", "version": 1 }, "end_va": 140716828041215, "entry_point": 140716828000256, "filename": "\\Windows\\System32\\rasadhlp.dll", "id": "region_356", "name": "rasadhlp.dll", "norm_filename": "c:\\windows\\system32\\rasadhlp.dll", "region_type": "memory_mapped_file", "start_va": 140716828000256, "timestamp": "00:00:22.520", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 425984, "start_va": 140716921454592, "type": "region", "version": 1 }, "end_va": 140716921880575, "entry_point": 140716921454592, "filename": "\\Windows\\System32\\FWPUCLNT.DLL", "id": "region_357", "name": "fwpuclnt.dll", "norm_filename": "c:\\windows\\system32\\fwpuclnt.dll", "region_type": "memory_mapped_file", "start_va": 140716921454592, "timestamp": "00:00:22.718", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 843568578560, "type": "region", "version": 1 }, "end_va": 843568586751, "entry_point": 0, "filename": null, "id": "region_358", "name": "pagefile_0x000000c4689b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843568578560, "timestamp": "00:00:22.736", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2572288, "start_va": 140716899303424, "type": "region", "version": 1 }, "end_va": 140716901875711, "entry_point": 140716899303424, "filename": "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll", "id": "region_359", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 140716899303424, "timestamp": "00:00:22.737", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 843568709632, "type": "region", "version": 1 }, "end_va": 843568721919, "entry_point": 843568709632, "filename": "\\Windows\\System32\\en-US\\mswsock.dll.mui", "id": "region_360", "name": "mswsock.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\mswsock.dll.mui", "region_type": "memory_mapped_file", "start_va": 843568709632, "timestamp": "00:00:23.128", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 843602460672, "type": "region", "version": 1 }, "end_va": 843602468863, "entry_point": 0, "filename": null, "id": "region_361", "name": "pagefile_0x000000c46aa00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 843602460672, "timestamp": "00:00:23.128", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000362-addr_0x000000c46b270000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_585", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843611308032, "type": "region", "version": 1 }, "end_va": 843612356607, "entry_point": 0, "filename": null, "id": "region_362", "name": "private_0x000000c46b270000", "norm_filename": null, "region_type": "private_memory", "start_va": 843611308032, "timestamp": "00:00:23.478", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000363-addr_0x000000c46b370000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_586", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843612356608, "type": "region", "version": 1 }, "end_va": 843613405183, "entry_point": 0, "filename": null, "id": "region_363", "name": "private_0x000000c46b370000", "norm_filename": null, "region_type": "private_memory", "start_va": 843612356608, "timestamp": "00:00:23.836", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000364-addr_0x00007ff76fe08000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_587", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140700710633472, "type": "region", "version": 1 }, "end_va": 140700710641663, "entry_point": 0, "filename": null, "id": "region_364", "name": "private_0x00007ff76fe08000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700710633472, "timestamp": "00:00:23.837", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000365-addr_0x000000c46b470000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_588", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843613405184, "type": "region", "version": 1 }, "end_va": 843614453759, "entry_point": 0, "filename": null, "id": "region_365", "name": "private_0x000000c46b470000", "norm_filename": null, "region_type": "private_memory", "start_va": 843613405184, "timestamp": "00:00:24.765", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000367-addr_0x000000c46b570000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_589", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 843614453760, "type": "region", "version": 1 }, "end_va": 843615502335, "entry_point": 0, "filename": null, "id": "region_367", "name": "private_0x000000c46b570000", "norm_filename": null, "region_type": "private_memory", "start_va": 843614453760, "timestamp": "00:00:24.814", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000368-addr_0x00007ff76fe06000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_590", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140700710625280, "type": "region", "version": 1 }, "end_va": 140700710633471, "entry_point": 0, "filename": null, "id": "region_368", "name": "private_0x00007ff76fe06000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700710625280, "timestamp": "00:00:24.814", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Windows\\System32\\cmd.exe\" /c call \"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\vwOrbzLbc.exe\"", "filename": "c:\\windows\\system32\\cmd.exe", "id": "proc_3", "image_name": "cmd.exe", "monitor_reason": "child_process", "monitored_id": 3, "origin_monitor_id": 1, "ref_parent_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000003-region_00000379-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable" ], "ref_process_dump": { "ref_id": "proc_dump_591", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_379", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:24.938", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000380-addr_0x0000004bba090000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_592", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 325243699200, "type": "region", "version": 1 }, "end_va": 325243830271, "entry_point": 0, "filename": null, "id": "region_380", "name": "private_0x0000004bba090000", "norm_filename": null, "region_type": "private_memory", "start_va": 325243699200, "timestamp": "00:00:24.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 325243830272, "type": "region", "version": 1 }, "end_va": 325243912191, "entry_point": 0, "filename": null, "id": "region_381", "name": "pagefile_0x0000004bba0b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 325243830272, "timestamp": "00:00:24.939", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000382-addr_0x0000004bba0d0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_593", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 325243961344, "type": "region", "version": 1 }, "end_va": 325245009919, "entry_point": 0, "filename": null, "id": "region_382", "name": "private_0x0000004bba0d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 325243961344, "timestamp": "00:00:24.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 325245009920, "type": "region", "version": 1 }, "end_va": 325245026303, "entry_point": 0, "filename": null, "id": "region_383", "name": "pagefile_0x0000004bba1d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 325245009920, "timestamp": "00:00:24.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 325245075456, "type": "region", "version": 1 }, "end_va": 325245079551, "entry_point": 0, "filename": null, "id": "region_384", "name": "pagefile_0x0000004bba1e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 325245075456, "timestamp": "00:00:24.939", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000385-addr_0x0000004bba1f0000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_594", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 325245140992, "type": "region", "version": 1 }, "end_va": 325245149183, "entry_point": 0, "filename": null, "id": "region_385", "name": "private_0x0000004bba1f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 325245140992, "timestamp": "00:00:24.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495506710528, "type": "region", "version": 1 }, "end_va": 140694529966079, "entry_point": 0, "filename": null, "id": "region_386", "name": "pagefile_0x00007df5ff7b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495506710528, "timestamp": "00:00:24.939", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140698266959872, "type": "region", "version": 1 }, "end_va": 140698267103231, "entry_point": 0, "filename": null, "id": "region_387", "name": "pagefile_0x00007ff6de390000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140698266959872, "timestamp": "00:00:24.939", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000388-addr_0x00007ff6de3b8000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_595", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 140698267123712, "type": "region", "version": 1 }, "end_va": 140698267127807, "entry_point": 0, "filename": null, "id": "region_388", "name": "private_0x00007ff6de3b8000", "norm_filename": null, "region_type": "private_memory", "start_va": 140698267123712, "timestamp": "00:00:24.940", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000389-addr_0x00007ff6de3be000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_596", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140698267148288, "type": "region", "version": 1 }, "end_va": 140698267156479, "entry_point": 0, "filename": null, "id": "region_389", "name": "private_0x00007ff6de3be000", "norm_filename": null, "region_type": "private_memory", "start_va": 140698267148288, "timestamp": "00:00:24.940", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 140698276659200, "type": "region", "version": 1 }, "end_va": 140698277023743, "entry_point": 140698276659200, "filename": "\\Windows\\System32\\cmd.exe", "id": "region_390", "name": "cmd.exe", "norm_filename": "c:\\windows\\system32\\cmd.exe", "region_type": "memory_mapped_file", "start_va": 140698276659200, "timestamp": "00:00:24.940", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_391", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:00:25.060", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000392-addr_0x0000004bba220000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_597", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 325245337600, "type": "region", "version": 1 }, "end_va": 325246386175, "entry_point": 0, "filename": null, "id": "region_392", "name": "private_0x0000004bba220000", "norm_filename": null, "region_type": "private_memory", "start_va": 325245337600, "timestamp": "00:00:25.089", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140716994985984, "type": "region", "version": 1 }, "end_va": 140716996939775, "entry_point": 140716994985984, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_393", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140716994985984, "timestamp": "00:00:25.089", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717039419392, "type": "region", "version": 1 }, "end_va": 140717040127999, "entry_point": 140717039419392, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_394", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717039419392, "timestamp": "00:00:25.089", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 325243699200, "type": "region", "version": 1 }, "end_va": 325243764735, "entry_point": 0, "filename": null, "id": "region_434", "name": "pagefile_0x0000004bba090000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 325243699200, "timestamp": "00:00:25.527", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000435-addr_0x0000004bba0a0000-size_0x0000000000007000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_611", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 28672, "start_va": 325243764736, "type": "region", "version": 1 }, "end_va": 325243793407, "entry_point": 0, "filename": null, "id": "region_435", "name": "private_0x0000004bba0a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 325243764736, "timestamp": "00:00:25.527", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 325246386176, "type": "region", "version": 1 }, "end_va": 325247164415, "entry_point": 325246386176, "filename": "\\Windows\\System32\\locale.nls", "id": "region_436", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 325246386176, "timestamp": "00:00:25.527", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000437-addr_0x0000004bba3e0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_612", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 325247172608, "type": "region", "version": 1 }, "end_va": 325248221183, "entry_point": 0, "filename": null, "id": "region_437", "name": "private_0x0000004bba3e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 325247172608, "timestamp": "00:00:25.528", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000438-addr_0x0000004bba5f0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_613", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 325249335296, "type": "region", "version": 1 }, "end_va": 325249400831, "entry_point": 0, "filename": null, "id": "region_438", "name": "private_0x0000004bba5f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 325249335296, "timestamp": "00:00:25.528", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140698265911296, "type": "region", "version": 1 }, "end_va": 140698266959871, "entry_point": 0, "filename": null, "id": "region_439", "name": "pagefile_0x00007ff6de290000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140698265911296, "timestamp": "00:00:25.528", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000440-addr_0x00007ff6de3bc000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_614", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140698267140096, "type": "region", "version": 1 }, "end_va": 140698267148287, "entry_point": 0, "filename": null, "id": "region_440", "name": "private_0x00007ff6de3bc000", "norm_filename": null, "region_type": "private_memory", "start_va": 140698267140096, "timestamp": "00:00:25.528", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717035945984, "type": "region", "version": 1 }, "end_va": 140717036589055, "entry_point": 140717035945984, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_441", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717035945984, "timestamp": "00:00:25.528", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000442-addr_0x0000004bba200000-size_0x0000000000007000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_615", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 28672, "start_va": 325245206528, "type": "region", "version": 1 }, "end_va": 325245235199, "entry_point": 0, "filename": null, "id": "region_442", "name": "private_0x0000004bba200000", "norm_filename": null, "region_type": "private_memory", "start_va": 325245206528, "timestamp": "00:00:25.537", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 325249400832, "type": "region", "version": 1 }, "end_va": 325252771839, "entry_point": 325249400832, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_443", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 325249400832, "timestamp": "00:00:25.610", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 491520, "start_va": 140716958744576, "type": "region", "version": 1 }, "end_va": 140716959236095, "entry_point": 140716958744576, "filename": "\\Windows\\System32\\apphelp.dll", "id": "region_444", "name": "apphelp.dll", "norm_filename": "c:\\windows\\system32\\apphelp.dll", "region_type": "memory_mapped_file", "start_va": 140716958744576, "timestamp": "00:00:25.651", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3735552, "start_va": 140698262175744, "type": "region", "version": 1 }, "end_va": 140698265911295, "entry_point": 140698262175744, "filename": "\\Windows\\AppPatch\\sysmain.sdb", "id": "region_462", "name": "sysmain.sdb", "norm_filename": "c:\\windows\\apppatch\\sysmain.sdb", "region_type": "memory_mapped_file", "start_va": 140698262175744, "timestamp": "00:00:25.895", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\vwOrbzLbc.exe\"", "filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe", "id": "proc_5", "image_name": "vworbzlbc.exe", "monitor_reason": "child_process", "monitored_id": 5, "origin_monitor_id": 3, "ref_parent_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000005-region_00000445-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_616", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_445", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:00:25.796", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000446-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_617", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_446", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:00:25.796", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 344063, "entry_point": 0, "filename": null, "id": "region_447", "name": "pagefile_0x0000000000040000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 262144, "timestamp": "00:00:25.796", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000448-addr_0x0000000000060000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_618", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 393216, "type": "region", "version": 1 }, "end_va": 655359, "entry_point": 0, "filename": null, "id": "region_448", "name": "private_0x0000000000060000", "norm_filename": null, "region_type": "private_memory", "start_va": 393216, "timestamp": "00:00:25.797", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000449-addr_0x00000000000a0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_619", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 655360, "type": "region", "version": 1 }, "end_va": 1703935, "entry_point": 0, "filename": null, "id": "region_449", "name": "private_0x00000000000a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 655360, "timestamp": "00:00:25.797", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 1703936, "type": "region", "version": 1 }, "end_va": 1720319, "entry_point": 0, "filename": null, "id": "region_450", "name": "pagefile_0x00000000001a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1703936, "timestamp": "00:00:25.797", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1769472, "type": "region", "version": 1 }, "end_va": 1777663, "entry_point": 0, "filename": null, "id": "region_451", "name": "pagefile_0x00000000001b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1769472, "timestamp": "00:00:25.797", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000452-addr_0x0000000000400000-size_0x000000000003c000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_620", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 245760, "start_va": 4194304, "type": "region", "version": 1 }, "end_va": 4440063, "entry_point": 4194304, "filename": "\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\vwOrbzLbc.exe", "id": "region_452", "name": "vworbzlbc.exe", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe", "region_type": "memory_mapped_file", "start_va": 4194304, "timestamp": "00:00:25.797", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1998127104, "type": "region", "version": 1 }, "end_va": 1999671295, "entry_point": 1998127104, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_453", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998127104, "timestamp": "00:00:25.798", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2147155968, "type": "region", "version": 1 }, "end_va": 2147299327, "entry_point": 0, "filename": null, "id": "region_454", "name": "pagefile_0x000000007ffb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2147155968, "timestamp": "00:00:25.886", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000455-addr_0x000000007ffdb000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_621", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2147332096, "type": "region", "version": 1 }, "end_va": 2147344383, "entry_point": 0, "filename": null, "id": "region_455", "name": "private_0x000000007ffdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147332096, "timestamp": "00:00:25.887", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000456-addr_0x000000007ffde000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_622", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2147344384, "type": "region", "version": 1 }, "end_va": 2147348479, "entry_point": 0, "filename": null, "id": "region_456", "name": "private_0x000000007ffde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147344384, "timestamp": "00:00:25.887", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000457-addr_0x000000007ffdf000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_623", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2147348480, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_457", "name": "private_0x000000007ffdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147348480, "timestamp": "00:00:25.887", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000458-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable" ], "ref_process_dump": { "ref_id": "proc_dump_624", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_458", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:25.888", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 140714892722176, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 140717040140287, "entry_point": 0, "filename": null, "id": "region_459", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:00:25.888", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_460", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:00:25.888", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20446306304, "start_va": 140717041983488, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_461", "name": "private_0x00007ffb3d4d2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140717041983488, "timestamp": "00:00:25.888", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000463-addr_0x00000000001c0000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_625", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 1835008, "type": "region", "version": 1 }, "end_va": 1843199, "entry_point": 0, "filename": null, "id": "region_463", "name": "private_0x00000000001c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1835008, "timestamp": "00:00:25.897", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000464-addr_0x0000000000370000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_626", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 3604480, "type": "region", "version": 1 }, "end_va": 3670015, "entry_point": 0, "filename": null, "id": "region_464", "name": "private_0x0000000000370000", "norm_filename": null, "region_type": "private_memory", "start_va": 3604480, "timestamp": "00:00:25.907", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1553989632, "type": "region", "version": 1 }, "end_va": 1554460671, "entry_point": 1553989632, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_465", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1553989632, "timestamp": "00:00:25.907", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1554513920, "type": "region", "version": 1 }, "end_va": 1554837503, "entry_point": 1554513920, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_466", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1554513920, "timestamp": "00:00:25.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1553924096, "type": "region", "version": 1 }, "end_va": 1553956863, "entry_point": 1553924096, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_467", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1553924096, "timestamp": "00:00:25.913", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000468-addr_0x0000000000590000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_627", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 5832704, "type": "region", "version": 1 }, "end_va": 6881279, "entry_point": 0, "filename": null, "id": "region_468", "name": "private_0x0000000000590000", "norm_filename": null, "region_type": "private_memory", "start_va": 5832704, "timestamp": "00:00:25.947", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1978793984, "type": "region", "version": 1 }, "end_va": 1980325887, "entry_point": 1978793984, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_469", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1978793984, "timestamp": "00:00:25.947", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1992032256, "type": "region", "version": 1 }, "end_va": 1993015295, "entry_point": 1992032256, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_470", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1992032256, "timestamp": "00:00:26.481", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_471", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:00:26.608", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000472-addr_0x0000000000020000-size_0x0000000000004000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_628", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 16384, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 147455, "entry_point": 0, "filename": null, "id": "region_472", "name": "private_0x0000000000020000", "norm_filename": null, "region_type": "private_memory", "start_va": 131072, "timestamp": "00:00:26.609", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 1900544, "type": "region", "version": 1 }, "end_va": 2678783, "entry_point": 1900544, "filename": "\\Windows\\System32\\locale.nls", "id": "region_473", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 1900544, "timestamp": "00:00:26.609", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000474-addr_0x0000000000290000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_629", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 2686976, "type": "region", "version": 1 }, "end_va": 2949119, "entry_point": 0, "filename": null, "id": "region_474", "name": "private_0x0000000000290000", "norm_filename": null, "region_type": "private_memory", "start_va": 2686976, "timestamp": "00:00:26.609", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000475-addr_0x0000000000440000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_630", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 4456448, "type": "region", "version": 1 }, "end_va": 5505023, "entry_point": 0, "filename": null, "id": "region_475", "name": "private_0x0000000000440000", "norm_filename": null, "region_type": "private_memory", "start_va": 4456448, "timestamp": "00:00:26.609", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2134016, "start_va": 1938751488, "type": "region", "version": 1 }, "end_va": 1940885503, "entry_point": 1938751488, "filename": "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll", "id": "region_476", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 1938751488, "timestamp": "00:00:26.609", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1948450816, "type": "region", "version": 1 }, "end_va": 1948815359, "entry_point": 1948450816, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_477", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1948450816, "timestamp": "00:00:26.613", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1948844032, "type": "region", "version": 1 }, "end_va": 1948884991, "entry_point": 1948844032, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_478", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1948844032, "timestamp": "00:00:26.614", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1948909568, "type": "region", "version": 1 }, "end_va": 1949032447, "entry_point": 1948909568, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_479", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1948909568, "timestamp": "00:00:26.615", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1310720, "start_va": 1951399936, "type": "region", "version": 1 }, "end_va": 1952710655, "entry_point": 1951399936, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_480", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1951399936, "timestamp": "00:00:26.616", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 958464, "start_va": 1952710656, "type": "region", "version": 1 }, "end_va": 1953669119, "entry_point": 1952710656, "filename": "\\Windows\\SysWOW64\\ole32.dll", "id": "region_481", "name": "ole32.dll", "norm_filename": "c:\\windows\\syswow64\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1952710656, "timestamp": "00:00:26.712", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20705280, "start_va": 1953890304, "type": "region", "version": 1 }, "end_va": 1974595583, "entry_point": 1953890304, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_482", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1953890304, "timestamp": "00:00:26.850", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1974992896, "type": "region", "version": 1 }, "end_va": 1975771135, "entry_point": 1974992896, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_483", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1974992896, "timestamp": "00:00:27.756", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1975779328, "type": "region", "version": 1 }, "end_va": 1976057855, "entry_point": 1975779328, "filename": "\\Windows\\SysWOW64\\powrprof.dll", "id": "region_484", "name": "powrprof.dll", "norm_filename": "c:\\windows\\syswow64\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 1975779328, "timestamp": "00:00:27.764", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1976827904, "type": "region", "version": 1 }, "end_va": 1977331711, "entry_point": 1976827904, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_485", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1976827904, "timestamp": "00:00:27.766", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1977352192, "type": "region", "version": 1 }, "end_va": 1977630719, "entry_point": 1977352192, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_486", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1977352192, "timestamp": "00:00:27.818", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1978073088, "type": "region", "version": 1 }, "end_va": 1978777599, "entry_point": 1978073088, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_487", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1978073088, "timestamp": "00:00:27.868", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1980366848, "type": "region", "version": 1 }, "end_va": 1980641279, "entry_point": 1980366848, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_488", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1980366848, "timestamp": "00:00:27.890", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 577536, "start_va": 1982332928, "type": "region", "version": 1 }, "end_va": 1982910463, "entry_point": 1982332928, "filename": "\\Windows\\SysWOW64\\SHCore.dll", "id": "region_489", "name": "shcore.dll", "norm_filename": "c:\\windows\\syswow64\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 1982332928, "timestamp": "00:00:27.892", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 5099520, "start_va": 1984757760, "type": "region", "version": 1 }, "end_va": 1989857279, "entry_point": 1984757760, "filename": "\\Windows\\SysWOW64\\windows.storage.dll", "id": "region_490", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\syswow64\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 1984757760, "timestamp": "00:00:27.894", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1363968, "start_va": 1989869568, "type": "region", "version": 1 }, "end_va": 1991233535, "entry_point": 1989869568, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_491", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1989869568, "timestamp": "00:00:27.897", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1810432, "start_va": 1993277440, "type": "region", "version": 1 }, "end_va": 1995087871, "entry_point": 1993277440, "filename": "\\Windows\\SysWOW64\\combase.dll", "id": "region_492", "name": "combase.dll", "norm_filename": "c:\\windows\\syswow64\\combase.dll", "region_type": "memory_mapped_file", "start_va": 1993277440, "timestamp": "00:00:27.951", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1995112448, "type": "region", "version": 1 }, "end_va": 1995161599, "entry_point": 1995112448, "filename": "\\Windows\\SysWOW64\\kernel.appcore.dll", "id": "region_493", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\syswow64\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 1995112448, "timestamp": "00:00:28.230", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 1996816384, "type": "region", "version": 1 }, "end_va": 1996877823, "entry_point": 1996816384, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_494", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1996816384, "timestamp": "00:00:28.232", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2146107392, "type": "region", "version": 1 }, "end_va": 2147155967, "entry_point": 0, "filename": null, "id": "region_495", "name": "pagefile_0x000000007feb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2146107392, "timestamp": "00:00:28.233", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000496-addr_0x000000007ffd8000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_631", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2147319808, "type": "region", "version": 1 }, "end_va": 2147332095, "entry_point": 0, "filename": null, "id": "region_496", "name": "private_0x000000007ffd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147319808, "timestamp": "00:00:28.233", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000497-addr_0x0000000000350000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_632", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 3473408, "type": "region", "version": 1 }, "end_va": 3538943, "entry_point": 0, "filename": null, "id": "region_497", "name": "private_0x0000000000350000", "norm_filename": null, "region_type": "private_memory", "start_va": 3473408, "timestamp": "00:00:28.298", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 6881280, "type": "region", "version": 1 }, "end_va": 8486911, "entry_point": 0, "filename": null, "id": "region_498", "name": "pagefile_0x0000000000690000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6881280, "timestamp": "00:00:28.298", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1953693696, "type": "region", "version": 1 }, "end_va": 1953869823, "entry_point": 1953693696, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_499", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1953693696, "timestamp": "00:00:28.298", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1179648, "start_va": 1996947456, "type": "region", "version": 1 }, "end_va": 1998127103, "entry_point": 1996947456, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_500", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1996947456, "timestamp": "00:00:28.300", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000501-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_633", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 200703, "entry_point": 0, "filename": null, "id": "region_501", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:00:28.331", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000502-addr_0x00000000002d0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_634", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2949120, "type": "region", "version": 1 }, "end_va": 2953215, "entry_point": 0, "filename": null, "id": "region_502", "name": "private_0x00000000002d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2949120, "timestamp": "00:00:28.331", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 3080192, "type": "region", "version": 1 }, "end_va": 3088383, "entry_point": 0, "filename": null, "id": "region_503", "name": "pagefile_0x00000000002f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3080192, "timestamp": "00:00:28.331", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 8519680, "type": "region", "version": 1 }, "end_va": 10096639, "entry_point": 0, "filename": null, "id": "region_504", "name": "pagefile_0x0000000000820000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8519680, "timestamp": "00:00:28.331", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 10158080, "type": "region", "version": 1 }, "end_va": 31129599, "entry_point": 0, "filename": null, "id": "region_505", "name": "pagefile_0x00000000009b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10158080, "timestamp": "00:00:28.332", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 479232, "start_va": 1947271168, "type": "region", "version": 1 }, "end_va": 1947750399, "entry_point": 1947271168, "filename": "\\Windows\\SysWOW64\\uxtheme.dll", "id": "region_506", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\syswow64\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 1947271168, "timestamp": "00:00:28.332", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000507-addr_0x0000000001db0000-size_0x0000000000130000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_635", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1245184, "start_va": 31129600, "type": "region", "version": 1 }, "end_va": 32374783, "entry_point": 0, "filename": null, "id": "region_507", "name": "private_0x0000000001db0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31129600, "timestamp": "00:00:28.562", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 102400, "start_va": 1936719872, "type": "region", "version": 1 }, "end_va": 1936822271, "entry_point": 1936719872, "filename": "\\Windows\\SysWOW64\\userenv.dll", "id": "region_508", "name": "userenv.dll", "norm_filename": "c:\\windows\\syswow64\\userenv.dll", "region_type": "memory_mapped_file", "start_va": 1936719872, "timestamp": "00:00:28.563", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1724416, "start_va": 1949630464, "type": "region", "version": 1 }, "end_va": 1951354879, "entry_point": 1949630464, "filename": "\\Windows\\SysWOW64\\setupapi.dll", "id": "region_509", "name": "setupapi.dll", "norm_filename": "c:\\windows\\syswow64\\setupapi.dll", "region_type": "memory_mapped_file", "start_va": 1949630464, "timestamp": "00:00:28.678", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 1993015296, "type": "region", "version": 1 }, "end_va": 1993236479, "entry_point": 1993015296, "filename": "\\Windows\\SysWOW64\\cfgmgr32.dll", "id": "region_510", "name": "cfgmgr32.dll", "norm_filename": "c:\\windows\\syswow64\\cfgmgr32.dll", "region_type": "memory_mapped_file", "start_va": 1993015296, "timestamp": "00:00:28.867", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 593920, "start_va": 1947795456, "type": "region", "version": 1 }, "end_va": 1948389375, "entry_point": 1947795456, "filename": "\\Windows\\SysWOW64\\apphelp.dll", "id": "region_511", "name": "apphelp.dll", "norm_filename": "c:\\windows\\syswow64\\apphelp.dll", "region_type": "memory_mapped_file", "start_va": 1947795456, "timestamp": "00:00:28.964", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1318912, "start_va": 1932263424, "type": "region", "version": 1 }, "end_va": 1933582335, "entry_point": 1932263424, "filename": "\\Windows\\SysWOW64\\propsys.dll", "id": "region_512", "name": "propsys.dll", "norm_filename": "c:\\windows\\syswow64\\propsys.dll", "region_type": "memory_mapped_file", "start_va": 1932263424, "timestamp": "00:00:29.116", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 1983578112, "type": "region", "version": 1 }, "end_va": 1984176127, "entry_point": 1983578112, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_513", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 1983578112, "timestamp": "00:00:29.287", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 118784, "start_va": 1947140096, "type": "region", "version": 1 }, "end_va": 1947258879, "entry_point": 1947140096, "filename": "\\Windows\\SysWOW64\\dwmapi.dll", "id": "region_514", "name": "dwmapi.dll", "norm_filename": "c:\\windows\\syswow64\\dwmapi.dll", "region_type": "memory_mapped_file", "start_va": 1947140096, "timestamp": "00:00:29.411", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 339968, "start_va": 1931870208, "type": "region", "version": 1 }, "end_va": 1932210175, "entry_point": 1931870208, "filename": "\\Windows\\SysWOW64\\oleacc.dll", "id": "region_515", "name": "oleacc.dll", "norm_filename": "c:\\windows\\syswow64\\oleacc.dll", "region_type": "memory_mapped_file", "start_va": 1931870208, "timestamp": "00:00:29.519", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 3014656, "type": "region", "version": 1 }, "end_va": 3022847, "entry_point": 3014656, "filename": "\\Windows\\SysWOW64\\oleaccrc.dll", "id": "region_516", "name": "oleaccrc.dll", "norm_filename": "c:\\windows\\syswow64\\oleaccrc.dll", "region_type": "memory_mapped_file", "start_va": 3014656, "timestamp": "00:00:29.662", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 532480, "start_va": 1949040640, "type": "region", "version": 1 }, "end_va": 1949573119, "entry_point": 1949040640, "filename": "\\Windows\\SysWOW64\\clbcatq.dll", "id": "region_517", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\syswow64\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 1949040640, "timestamp": "00:00:29.667", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1943339008, "type": "region", "version": 1 }, "end_va": 1943371775, "entry_point": 1943339008, "filename": "\\Windows\\SysWOW64\\version.dll", "id": "region_518", "name": "version.dll", "norm_filename": "c:\\windows\\syswow64\\version.dll", "region_type": "memory_mapped_file", "start_va": 1943339008, "timestamp": "00:00:29.766", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 1931804672, "type": "region", "version": 1 }, "end_va": 1931829247, "entry_point": 1931804672, "filename": "\\Windows\\SysWOW64\\shfolder.dll", "id": "region_519", "name": "shfolder.dll", "norm_filename": "c:\\windows\\syswow64\\shfolder.dll", "region_type": "memory_mapped_file", "start_va": 1931804672, "timestamp": "00:00:29.815", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000520-addr_0x0000000000300000-size_0x0000000000004000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_636", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 16384, "start_va": 3145728, "type": "region", "version": 1 }, "end_va": 3162111, "entry_point": 0, "filename": null, "id": "region_520", "name": "private_0x0000000000300000", "norm_filename": null, "region_type": "private_memory", "start_va": 3145728, "timestamp": "00:00:29.819", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 3211264, "type": "region", "version": 1 }, "end_va": 3215359, "entry_point": 0, "filename": null, "id": "region_521", "name": "pagefile_0x0000000000310000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3211264, "timestamp": "00:00:29.844", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 32374784, "type": "region", "version": 1 }, "end_va": 35745791, "entry_point": 32374784, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_522", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 32374784, "timestamp": "00:00:29.845", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 3276800, "type": "region", "version": 1 }, "end_va": 3280895, "entry_point": 0, "filename": null, "id": "region_523", "name": "pagefile_0x0000000000320000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3276800, "timestamp": "00:00:29.854", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000524-addr_0x0000000000380000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_637", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 3670016, "type": "region", "version": 1 }, "end_va": 3932159, "entry_point": 0, "filename": null, "id": "region_524", "name": "private_0x0000000000380000", "norm_filename": null, "region_type": "private_memory", "start_va": 3670016, "timestamp": "00:00:29.855", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000525-addr_0x0000000001db0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_638", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 31129600, "type": "region", "version": 1 }, "end_va": 32178175, "entry_point": 0, "filename": null, "id": "region_525", "name": "private_0x0000000001db0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31129600, "timestamp": "00:00:29.856", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000526-addr_0x0000000001ed0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_639", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 32309248, "type": "region", "version": 1 }, "end_va": 32374783, "entry_point": 0, "filename": null, "id": "region_526", "name": "private_0x0000000001ed0000", "norm_filename": null, "region_type": "private_memory", "start_va": 32309248, "timestamp": "00:00:29.856", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000527-addr_0x000000007ffd5000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_640", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2147307520, "type": "region", "version": 1 }, "end_va": 2147319807, "entry_point": 0, "filename": null, "id": "region_527", "name": "private_0x000000007ffd5000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147307520, "timestamp": "00:00:29.856", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 3342336, "type": "region", "version": 1 }, "end_va": 3346431, "entry_point": 0, "filename": null, "id": "region_528", "name": "pagefile_0x0000000000330000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3342336, "timestamp": "00:00:29.857", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 3407872, "type": "region", "version": 1 }, "end_va": 3424255, "entry_point": 3407872, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "id": "region_529", "name": "cversions.1.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db", "region_type": "memory_mapped_file", "start_va": 3407872, "timestamp": "00:00:29.858", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 139264, "start_va": 3932160, "type": "region", "version": 1 }, "end_va": 4071423, "entry_point": 3932160, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db", "id": "region_530", "name": "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db", "region_type": "memory_mapped_file", "start_va": 3932160, "timestamp": "00:00:29.859", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 3538944, "type": "region", "version": 1 }, "end_va": 3543039, "entry_point": 0, "filename": null, "id": "region_531", "name": "pagefile_0x0000000000360000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3538944, "timestamp": "00:00:29.860", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000532-addr_0x0000000002220000-size_0x000000000080b000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_641", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8433664, "start_va": 35782656, "type": "region", "version": 1 }, "end_va": 44216319, "entry_point": 0, "filename": null, "id": "region_532", "name": "private_0x0000000002220000", "norm_filename": null, "region_type": "private_memory", "start_va": 35782656, "timestamp": "00:00:29.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 3407872, "type": "region", "version": 1 }, "end_va": 3420159, "entry_point": 0, "filename": null, "id": "region_533", "name": "pagefile_0x0000000000340000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3407872, "timestamp": "00:00:29.908", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000534-addr_0x0000000010000000-size_0x0000000000006000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_642", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 24576, "start_va": 268435456, "type": "region", "version": 1 }, "end_va": 268460031, "entry_point": 268435456, "filename": "\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\nsmA14E.tmp\\System.dll", "id": "region_534", "name": "system.dll", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsma14e.tmp\\system.dll", "region_type": "memory_mapped_file", "start_va": 268435456, "timestamp": "00:00:29.914", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000535-addr_0x0000000000540000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_643", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 5505024, "type": "region", "version": 1 }, "end_va": 5767167, "entry_point": 0, "filename": null, "id": "region_535", "name": "private_0x0000000000540000", "norm_filename": null, "region_type": "private_memory", "start_va": 5505024, "timestamp": "00:00:29.917", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000536-addr_0x0000000002a30000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_644", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 44236800, "type": "region", "version": 1 }, "end_va": 45285375, "entry_point": 0, "filename": null, "id": "region_536", "name": "private_0x0000000002a30000", "norm_filename": null, "region_type": "private_memory", "start_va": 44236800, "timestamp": "00:00:29.918", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000537-addr_0x000000007fead000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_645", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2146095104, "type": "region", "version": 1 }, "end_va": 2146107391, "entry_point": 0, "filename": null, "id": "region_537", "name": "private_0x000000007fead000", "norm_filename": null, "region_type": "private_memory", "start_va": 2146095104, "timestamp": "00:00:29.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 100007936, "start_va": 45285376, "type": "region", "version": 1 }, "end_va": 145293311, "entry_point": 0, "filename": null, "id": "region_538", "name": "private_0x0000000002b30000", "norm_filename": null, "region_type": "private_memory", "start_va": 45285376, "timestamp": "00:00:29.922", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 73728, "start_va": 32178176, "type": "region", "version": 1 }, "end_va": 32251903, "entry_point": 0, "filename": null, "id": "region_539", "name": "pagefile_0x0000000001eb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 32178176, "timestamp": "00:00:30.083", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 1931673600, "type": "region", "version": 1 }, "end_va": 1931751423, "entry_point": 1931673600, "filename": "\\Windows\\SysWOW64\\cryptsp.dll", "id": "region_540", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\syswow64\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 1931673600, "timestamp": "00:00:36.360", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 110592, "start_va": 1936588800, "type": "region", "version": 1 }, "end_va": 1936699391, "entry_point": 1936588800, "filename": "\\Windows\\SysWOW64\\bcrypt.dll", "id": "region_541", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\syswow64\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 1936588800, "timestamp": "00:00:36.466", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 192512, "start_va": 1931476992, "type": "region", "version": 1 }, "end_va": 1931669503, "entry_point": 1931476992, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_542", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 1931476992, "timestamp": "00:00:36.539", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000543-addr_0x0000000000340000-size_0x000000000000e000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_646", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 57344, "start_va": 3407872, "type": "region", "version": 1 }, "end_va": 3465215, "entry_point": 0, "filename": null, "id": "region_543", "name": "private_0x0000000000340000", "norm_filename": null, "region_type": "private_memory", "start_va": 3407872, "timestamp": "00:00:36.651", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000562-addr_0x0000000008a90000-size_0x0000000000177000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_657", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1536000, "start_va": 145293312, "type": "region", "version": 1 }, "end_va": 146829311, "entry_point": 0, "filename": null, "id": "region_562", "name": "private_0x0000000008a90000", "norm_filename": null, "region_type": "private_memory", "start_va": 145293312, "timestamp": "00:00:36.692", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000005-region_00000563-addr_0x0000000008c10000-size_0x0000000000179000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_658", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1544192, "start_va": 146866176, "type": "region", "version": 1 }, "end_va": 148410367, "entry_point": 0, "filename": null, "id": "region_563", "name": "private_0x0000000008c10000", "norm_filename": null, "region_type": "private_memory", "start_va": 146866176, "timestamp": "00:00:36.722", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 4128768, "type": "region", "version": 1 }, "end_va": 4190207, "entry_point": 0, "filename": null, "id": "region_571", "name": "pagefile_0x00000000003f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4128768, "timestamp": "00:00:36.906", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\vwOrbzLbc.exe\"", "filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe", "id": "proc_6", "image_name": "vworbzlbc.exe", "monitor_reason": "child_process", "monitored_id": 6, "origin_monitor_id": 5, "ref_parent_process": { "ref_id": "proc_5", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000006-region_00000544-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_647", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_544", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:00:36.664", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000545-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_648", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_545", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:00:36.664", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 344063, "entry_point": 0, "filename": null, "id": "region_546", "name": "pagefile_0x0000000000040000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 262144, "timestamp": "00:00:36.664", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000547-addr_0x0000000000060000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_649", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 393216, "type": "region", "version": 1 }, "end_va": 655359, "entry_point": 0, "filename": null, "id": "region_547", "name": "private_0x0000000000060000", "norm_filename": null, "region_type": "private_memory", "start_va": 393216, "timestamp": "00:00:36.664", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000548-addr_0x00000000000a0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_650", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 655360, "type": "region", "version": 1 }, "end_va": 1703935, "entry_point": 0, "filename": null, "id": "region_548", "name": "private_0x00000000000a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 655360, "timestamp": "00:00:36.665", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 1703936, "type": "region", "version": 1 }, "end_va": 1720319, "entry_point": 0, "filename": null, "id": "region_549", "name": "pagefile_0x00000000001a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1703936, "timestamp": "00:00:36.665", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1769472, "type": "region", "version": 1 }, "end_va": 1777663, "entry_point": 0, "filename": null, "id": "region_550", "name": "pagefile_0x00000000001b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1769472, "timestamp": "00:00:36.665", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000551-addr_0x00000000001c0000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_651", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 1835008, "type": "region", "version": 1 }, "end_va": 1843199, "entry_point": 0, "filename": null, "id": "region_551", "name": "private_0x00000000001c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1835008, "timestamp": "00:00:36.665", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000552-addr_0x0000000000400000-size_0x000000000003c000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_652", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 245760, "start_va": 4194304, "type": "region", "version": 1 }, "end_va": 4440063, "entry_point": 4194304, "filename": "\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\vwOrbzLbc.exe", "id": "region_552", "name": "vworbzlbc.exe", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe", "region_type": "memory_mapped_file", "start_va": 4194304, "timestamp": "00:00:36.665", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1998127104, "type": "region", "version": 1 }, "end_va": 1999671295, "entry_point": 1998127104, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_553", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998127104, "timestamp": "00:00:36.665", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2147155968, "type": "region", "version": 1 }, "end_va": 2147299327, "entry_point": 0, "filename": null, "id": "region_554", "name": "pagefile_0x000000007ffb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2147155968, "timestamp": "00:00:36.665", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000555-addr_0x000000007ffdb000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_653", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2147332096, "type": "region", "version": 1 }, "end_va": 2147344383, "entry_point": 0, "filename": null, "id": "region_555", "name": "private_0x000000007ffdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147332096, "timestamp": "00:00:36.665", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000556-addr_0x000000007ffde000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_654", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2147344384, "type": "region", "version": 1 }, "end_va": 2147348479, "entry_point": 0, "filename": null, "id": "region_556", "name": "private_0x000000007ffde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147344384, "timestamp": "00:00:36.666", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000557-addr_0x000000007ffdf000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_655", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2147348480, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_557", "name": "private_0x000000007ffdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147348480, "timestamp": "00:00:36.666", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000558-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable" ], "ref_process_dump": { "ref_id": "proc_dump_656", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_558", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:36.666", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 140714892722176, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 140717040140287, "entry_point": 0, "filename": null, "id": "region_559", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:00:36.666", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_560", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:00:36.666", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20446306304, "start_va": 140717041983488, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_561", "name": "private_0x00007ffb3d4d2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140717041983488, "timestamp": "00:00:36.666", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 4194304, "type": "region", "version": 1 }, "end_va": 4255743, "entry_point": 0, "filename": null, "id": "region_568", "name": "pagefile_0x0000000000400000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4194304, "timestamp": "00:00:36.859", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000576-addr_0x0000000000390000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_669", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 3735552, "type": "region", "version": 1 }, "end_va": 3801087, "entry_point": 0, "filename": null, "id": "region_576", "name": "private_0x0000000000390000", "norm_filename": null, "region_type": "private_memory", "start_va": 3735552, "timestamp": "00:00:37.013", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1553989632, "type": "region", "version": 1 }, "end_va": 1554460671, "entry_point": 1553989632, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_577", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1553989632, "timestamp": "00:00:37.013", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1554513920, "type": "region", "version": 1 }, "end_va": 1554837503, "entry_point": 1554513920, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_578", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1554513920, "timestamp": "00:00:37.013", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000579-addr_0x0000000000260000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_670", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 2490368, "type": "region", "version": 1 }, "end_va": 3538943, "entry_point": 0, "filename": null, "id": "region_579", "name": "private_0x0000000000260000", "norm_filename": null, "region_type": "private_memory", "start_va": 2490368, "timestamp": "00:00:37.019", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1553924096, "type": "region", "version": 1 }, "end_va": 1553956863, "entry_point": 1553924096, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_580", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1553924096, "timestamp": "00:00:37.019", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_583", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:00:37.082", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000584-addr_0x0000000000020000-size_0x0000000000004000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_673", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 16384, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 147455, "entry_point": 0, "filename": null, "id": "region_584", "name": "private_0x0000000000020000", "norm_filename": null, "region_type": "private_memory", "start_va": 131072, "timestamp": "00:00:37.082", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000585-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_674", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 200703, "entry_point": 0, "filename": null, "id": "region_585", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:00:37.082", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000586-addr_0x00000000001d0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_675", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 1900544, "type": "region", "version": 1 }, "end_va": 2162687, "entry_point": 0, "filename": null, "id": "region_586", "name": "private_0x00000000001d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1900544, "timestamp": "00:00:37.083", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000587-addr_0x0000000000210000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_676", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2162688, "type": "region", "version": 1 }, "end_va": 2166783, "entry_point": 0, "filename": null, "id": "region_587", "name": "private_0x0000000000210000", "norm_filename": null, "region_type": "private_memory", "start_va": 2162688, "timestamp": "00:00:37.083", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 4259840, "type": "region", "version": 1 }, "end_va": 5038079, "entry_point": 4259840, "filename": "\\Windows\\System32\\locale.nls", "id": "region_588", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 4259840, "timestamp": "00:00:37.083", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000589-addr_0x00000000004d0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_677", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 5046272, "type": "region", "version": 1 }, "end_va": 6094847, "entry_point": 0, "filename": null, "id": "region_589", "name": "private_0x00000000004d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 5046272, "timestamp": "00:00:37.083", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 6094848, "type": "region", "version": 1 }, "end_va": 7700479, "entry_point": 0, "filename": null, "id": "region_590", "name": "pagefile_0x00000000005d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6094848, "timestamp": "00:00:37.083", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000591-addr_0x0000000000810000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_678", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 8454144, "type": "region", "version": 1 }, "end_va": 8519679, "entry_point": 0, "filename": null, "id": "region_591", "name": "private_0x0000000000810000", "norm_filename": null, "region_type": "private_memory", "start_va": 8454144, "timestamp": "00:00:37.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 8519680, "type": "region", "version": 1 }, "end_va": 10096639, "entry_point": 0, "filename": null, "id": "region_592", "name": "pagefile_0x0000000000820000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8519680, "timestamp": "00:00:37.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 10158080, "type": "region", "version": 1 }, "end_va": 31129599, "entry_point": 0, "filename": null, "id": "region_593", "name": "pagefile_0x00000000009b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10158080, "timestamp": "00:00:37.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1948450816, "type": "region", "version": 1 }, "end_va": 1948815359, "entry_point": 1948450816, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_594", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1948450816, "timestamp": "00:00:37.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1948844032, "type": "region", "version": 1 }, "end_va": 1948884991, "entry_point": 1948844032, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_595", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1948844032, "timestamp": "00:00:37.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1948909568, "type": "region", "version": 1 }, "end_va": 1949032447, "entry_point": 1948909568, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_596", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1948909568, "timestamp": "00:00:37.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1310720, "start_va": 1951399936, "type": "region", "version": 1 }, "end_va": 1952710655, "entry_point": 1951399936, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_597", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1951399936, "timestamp": "00:00:37.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1953693696, "type": "region", "version": 1 }, "end_va": 1953869823, "entry_point": 1953693696, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_598", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1953693696, "timestamp": "00:00:37.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20705280, "start_va": 1953890304, "type": "region", "version": 1 }, "end_va": 1974595583, "entry_point": 1953890304, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_599", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1953890304, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1974992896, "type": "region", "version": 1 }, "end_va": 1975771135, "entry_point": 1974992896, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_600", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1974992896, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1975779328, "type": "region", "version": 1 }, "end_va": 1976057855, "entry_point": 1975779328, "filename": "\\Windows\\SysWOW64\\powrprof.dll", "id": "region_601", "name": "powrprof.dll", "norm_filename": "c:\\windows\\syswow64\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 1975779328, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1976827904, "type": "region", "version": 1 }, "end_va": 1977331711, "entry_point": 1976827904, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_602", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1976827904, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1977352192, "type": "region", "version": 1 }, "end_va": 1977630719, "entry_point": 1977352192, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_603", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1977352192, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1978073088, "type": "region", "version": 1 }, "end_va": 1978777599, "entry_point": 1978073088, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_604", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1978073088, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1978793984, "type": "region", "version": 1 }, "end_va": 1980325887, "entry_point": 1978793984, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_605", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1978793984, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1980366848, "type": "region", "version": 1 }, "end_va": 1980641279, "entry_point": 1980366848, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_606", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1980366848, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 577536, "start_va": 1982332928, "type": "region", "version": 1 }, "end_va": 1982910463, "entry_point": 1982332928, "filename": "\\Windows\\SysWOW64\\SHCore.dll", "id": "region_607", "name": "shcore.dll", "norm_filename": "c:\\windows\\syswow64\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 1982332928, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 5099520, "start_va": 1984757760, "type": "region", "version": 1 }, "end_va": 1989857279, "entry_point": 1984757760, "filename": "\\Windows\\SysWOW64\\windows.storage.dll", "id": "region_608", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\syswow64\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 1984757760, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1363968, "start_va": 1989869568, "type": "region", "version": 1 }, "end_va": 1991233535, "entry_point": 1989869568, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_609", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1989869568, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1992032256, "type": "region", "version": 1 }, "end_va": 1993015295, "entry_point": 1992032256, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_610", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1992032256, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1810432, "start_va": 1993277440, "type": "region", "version": 1 }, "end_va": 1995087871, "entry_point": 1993277440, "filename": "\\Windows\\SysWOW64\\combase.dll", "id": "region_611", "name": "combase.dll", "norm_filename": "c:\\windows\\syswow64\\combase.dll", "region_type": "memory_mapped_file", "start_va": 1993277440, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1995112448, "type": "region", "version": 1 }, "end_va": 1995161599, "entry_point": 1995112448, "filename": "\\Windows\\SysWOW64\\kernel.appcore.dll", "id": "region_612", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\syswow64\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 1995112448, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 1996816384, "type": "region", "version": 1 }, "end_va": 1996877823, "entry_point": 1996816384, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_613", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1996816384, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1179648, "start_va": 1996947456, "type": "region", "version": 1 }, "end_va": 1998127103, "entry_point": 1996947456, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_614", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1996947456, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2146107392, "type": "region", "version": 1 }, "end_va": 2147155967, "entry_point": 0, "filename": null, "id": "region_615", "name": "pagefile_0x000000007feb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2146107392, "timestamp": "00:00:37.085", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000616-addr_0x000000007ffd8000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_679", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2147319808, "type": "region", "version": 1 }, "end_va": 2147332095, "entry_point": 0, "filename": null, "id": "region_616", "name": "private_0x000000007ffd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147319808, "timestamp": "00:00:37.087", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000617-addr_0x0000000000220000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_680", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2228224, "type": "region", "version": 1 }, "end_va": 2293759, "entry_point": 0, "filename": null, "id": "region_617", "name": "private_0x0000000000220000", "norm_filename": null, "region_type": "private_memory", "start_va": 2228224, "timestamp": "00:00:37.087", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000618-addr_0x0000000001db0000-size_0x00000000001a0000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_681", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1703936, "start_va": 31129600, "type": "region", "version": 1 }, "end_va": 32833535, "entry_point": 0, "filename": null, "id": "region_618", "name": "private_0x0000000001db0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31129600, "timestamp": "00:00:37.088", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 32833536, "type": "region", "version": 1 }, "end_va": 36204543, "entry_point": 32833536, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_619", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 32833536, "timestamp": "00:00:37.089", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 163840, "start_va": 1931280384, "type": "region", "version": 1 }, "end_va": 1931444223, "entry_point": 1931280384, "filename": "\\Windows\\SysWOW64\\ntmarta.dll", "id": "region_620", "name": "ntmarta.dll", "norm_filename": "c:\\windows\\syswow64\\ntmarta.dll", "region_type": "memory_mapped_file", "start_va": 1931280384, "timestamp": "00:00:37.093", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 1931673600, "type": "region", "version": 1 }, "end_va": 1931751423, "entry_point": 1931673600, "filename": "\\Windows\\SysWOW64\\cryptsp.dll", "id": "region_621", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\syswow64\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 1931673600, "timestamp": "00:00:37.243", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 110592, "start_va": 1936588800, "type": "region", "version": 1 }, "end_va": 1936699391, "entry_point": 1936588800, "filename": "\\Windows\\SysWOW64\\bcrypt.dll", "id": "region_622", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\syswow64\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 1936588800, "timestamp": "00:00:37.244", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 192512, "start_va": 1931476992, "type": "region", "version": 1 }, "end_va": 1931669503, "entry_point": 1931476992, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_623", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 1931476992, "timestamp": "00:00:37.246", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000624-addr_0x0000000000230000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_682", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2293760, "type": "region", "version": 1 }, "end_va": 2359295, "entry_point": 0, "filename": null, "id": "region_624", "name": "private_0x0000000000230000", "norm_filename": null, "region_type": "private_memory", "start_va": 2293760, "timestamp": "00:00:37.470", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16809984, "start_va": 36241408, "type": "region", "version": 1 }, "end_va": 53051391, "entry_point": 0, "filename": null, "id": "region_625", "name": "private_0x0000000002290000", "norm_filename": null, "region_type": "private_memory", "start_va": 36241408, "timestamp": "00:00:37.471", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000626-addr_0x0000000001db0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_683", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 31129600, "type": "region", "version": 1 }, "end_va": 32178175, "entry_point": 0, "filename": null, "id": "region_626", "name": "private_0x0000000001db0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31129600, "timestamp": "00:00:37.472", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000627-addr_0x0000000001f40000-size_0x0000000000010000-perm_rw.bin", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_684", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 32768000, "type": "region", "version": 1 }, "end_va": 32833535, "entry_point": 0, "filename": null, "id": "region_627", "name": "private_0x0000000001f40000", "norm_filename": null, "region_type": "private_memory", "start_va": 32768000, "timestamp": "00:00:37.473", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000628-addr_0x0000000000230000-size_0x0000000000016000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_685", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 90112, "start_va": 2293760, "type": "region", "version": 1 }, "end_va": 2383871, "entry_point": 0, "filename": null, "id": "region_628", "name": "private_0x0000000000230000", "norm_filename": null, "region_type": "private_memory", "start_va": 2293760, "timestamp": "00:00:37.475", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 2424832, "type": "region", "version": 1 }, "end_va": 2461695, "entry_point": 0, "filename": null, "id": "region_629", "name": "pagefile_0x0000000000250000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2424832, "timestamp": "00:00:37.476", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 2293760, "type": "region", "version": 1 }, "end_va": 2330623, "entry_point": 0, "filename": null, "id": "region_630", "name": "pagefile_0x0000000000230000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2293760, "timestamp": "00:00:37.478", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000670-addr_0x0000000003490000-size_0x0000000000010000-perm_rw.bin", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_686", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 55115776, "type": "region", "version": 1 }, "end_va": 55181311, "entry_point": 0, "filename": null, "id": "region_670", "name": "private_0x0000000003490000", "norm_filename": null, "region_type": "private_memory", "start_va": 55115776, "timestamp": "00:00:37.595", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "taskkill /F /T /PID 2784", "filename": "c:\\windows\\syswow64\\taskkill.exe", "id": "proc_7", "image_name": "taskkill.exe", "monitor_reason": "child_process", "monitored_id": 7, "origin_monitor_id": 6, "ref_parent_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000007-region_00000671-addr_0x0000000000b20000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_687", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 11665408, "type": "region", "version": 1 }, "end_va": 11796479, "entry_point": 0, "filename": null, "id": "region_671", "name": "private_0x0000000000b20000", "norm_filename": null, "region_type": "private_memory", "start_va": 11665408, "timestamp": "00:00:37.599", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000672-addr_0x0000000000b40000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_688", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 11796480, "type": "region", "version": 1 }, "end_va": 11804671, "entry_point": 0, "filename": null, "id": "region_672", "name": "private_0x0000000000b40000", "norm_filename": null, "region_type": "private_memory", "start_va": 11796480, "timestamp": "00:00:37.600", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 11862016, "type": "region", "version": 1 }, "end_va": 11943935, "entry_point": 0, "filename": null, "id": "region_673", "name": "pagefile_0x0000000000b50000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 11862016, "timestamp": "00:00:37.600", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000674-addr_0x0000000000b70000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_689", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 11993088, "type": "region", "version": 1 }, "end_va": 12255231, "entry_point": 0, "filename": null, "id": "region_674", "name": "private_0x0000000000b70000", "norm_filename": null, "region_type": "private_memory", "start_va": 11993088, "timestamp": "00:00:37.600", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000675-addr_0x0000000000bb0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_690", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 12255232, "type": "region", "version": 1 }, "end_va": 12517375, "entry_point": 0, "filename": null, "id": "region_675", "name": "private_0x0000000000bb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 12255232, "timestamp": "00:00:37.600", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 12517376, "type": "region", "version": 1 }, "end_va": 12533759, "entry_point": 0, "filename": null, "id": "region_676", "name": "pagefile_0x0000000000bf0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 12517376, "timestamp": "00:00:37.600", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 12582912, "type": "region", "version": 1 }, "end_va": 12587007, "entry_point": 0, "filename": null, "id": "region_677", "name": "pagefile_0x0000000000c00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 12582912, "timestamp": "00:00:37.600", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000678-addr_0x0000000000c10000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_691", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 12648448, "type": "region", "version": 1 }, "end_va": 12656639, "entry_point": 0, "filename": null, "id": "region_678", "name": "private_0x0000000000c10000", "norm_filename": null, "region_type": "private_memory", "start_va": 12648448, "timestamp": "00:00:37.600", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 90112, "start_va": 19726336, "type": "region", "version": 1 }, "end_va": 19816447, "entry_point": 19726336, "filename": "\\Windows\\SysWOW64\\taskkill.exe", "id": "region_679", "name": "taskkill.exe", "norm_filename": "c:\\windows\\syswow64\\taskkill.exe", "region_type": "memory_mapped_file", "start_va": 19726336, "timestamp": "00:00:37.601", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 19857408, "type": "region", "version": 1 }, "end_va": 86966271, "entry_point": 0, "filename": null, "id": "region_680", "name": "pagefile_0x00000000012f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 19857408, "timestamp": "00:00:37.688", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1998127104, "type": "region", "version": 1 }, "end_va": 1999671295, "entry_point": 1998127104, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_681", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998127104, "timestamp": "00:00:37.688", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2126446592, "type": "region", "version": 1 }, "end_va": 2126589951, "entry_point": 0, "filename": null, "id": "region_682", "name": "pagefile_0x000000007ebf0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2126446592, "timestamp": "00:00:37.688", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000683-addr_0x000000007ec14000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_692", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2126594048, "type": "region", "version": 1 }, "end_va": 2126598143, "entry_point": 0, "filename": null, "id": "region_683", "name": "private_0x000000007ec14000", "norm_filename": null, "region_type": "private_memory", "start_va": 2126594048, "timestamp": "00:00:37.689", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000684-addr_0x000000007ec1c000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_693", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2126626816, "type": "region", "version": 1 }, "end_va": 2126639103, "entry_point": 0, "filename": null, "id": "region_684", "name": "private_0x000000007ec1c000", "norm_filename": null, "region_type": "private_memory", "start_va": 2126626816, "timestamp": "00:00:37.689", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000685-addr_0x000000007ec1f000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_694", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2126639104, "type": "region", "version": 1 }, "end_va": 2126643199, "entry_point": 0, "filename": null, "id": "region_685", "name": "private_0x000000007ec1f000", "norm_filename": null, "region_type": "private_memory", "start_va": 2126639104, "timestamp": "00:00:37.689", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000686-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable" ], "ref_process_dump": { "ref_id": "proc_dump_695", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_686", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:37.689", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138515869466624, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138518016884735, "entry_point": 0, "filename": null, "id": "region_687", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:00:37.689", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138518016884736, "type": "region", "version": 1 }, "end_va": 140717040140287, "entry_point": 0, "filename": null, "id": "region_688", "name": "pagefile_0x00007dfb3d310000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138518016884736, "timestamp": "00:00:37.689", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_689", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:00:37.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20446306304, "start_va": 140717041983488, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_690", "name": "private_0x00007ffb3d4d2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140717041983488, "timestamp": "00:00:37.690", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000714-addr_0x0000000000d70000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_696", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 14090240, "type": "region", "version": 1 }, "end_va": 14155775, "entry_point": 0, "filename": null, "id": "region_714", "name": "private_0x0000000000d70000", "norm_filename": null, "region_type": "private_memory", "start_va": 14090240, "timestamp": "00:00:37.792", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1553989632, "type": "region", "version": 1 }, "end_va": 1554460671, "entry_point": 1553989632, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_715", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1553989632, "timestamp": "00:00:37.792", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1554513920, "type": "region", "version": 1 }, "end_va": 1554837503, "entry_point": 1554513920, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_716", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1554513920, "timestamp": "00:00:37.792", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000717-addr_0x0000000000e80000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_697", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 15204352, "type": "region", "version": 1 }, "end_va": 16252927, "entry_point": 0, "filename": null, "id": "region_717", "name": "private_0x0000000000e80000", "norm_filename": null, "region_type": "private_memory", "start_va": 15204352, "timestamp": "00:00:37.802", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1553924096, "type": "region", "version": 1 }, "end_va": 1553956863, "entry_point": 1553924096, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_718", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1553924096, "timestamp": "00:00:37.802", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 11665408, "type": "region", "version": 1 }, "end_va": 11730943, "entry_point": 0, "filename": null, "id": "region_759", "name": "pagefile_0x0000000000b20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 11665408, "timestamp": "00:00:38.806", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000760-addr_0x0000000000b30000-size_0x0000000000004000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_712", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 16384, "start_va": 11730944, "type": "region", "version": 1 }, "end_va": 11747327, "entry_point": 0, "filename": null, "id": "region_760", "name": "private_0x0000000000b30000", "norm_filename": null, "region_type": "private_memory", "start_va": 11730944, "timestamp": "00:00:38.806", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20480, "start_va": 11796480, "type": "region", "version": 1 }, "end_va": 11816959, "entry_point": 11796480, "filename": "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui", "id": "region_761", "name": "taskkill.exe.mui", "norm_filename": "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui", "region_type": "memory_mapped_file", "start_va": 11796480, "timestamp": "00:00:38.806", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 12713984, "type": "region", "version": 1 }, "end_va": 13492223, "entry_point": 12713984, "filename": "\\Windows\\System32\\locale.nls", "id": "region_762", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 12713984, "timestamp": "00:00:38.806", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000763-addr_0x0000000000ce0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_713", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 13500416, "type": "region", "version": 1 }, "end_va": 13762559, "entry_point": 0, "filename": null, "id": "region_763", "name": "private_0x0000000000ce0000", "norm_filename": null, "region_type": "private_memory", "start_va": 13500416, "timestamp": "00:00:38.807", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000764-addr_0x0000000000d20000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_714", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 13762560, "type": "region", "version": 1 }, "end_va": 14024703, "entry_point": 0, "filename": null, "id": "region_764", "name": "private_0x0000000000d20000", "norm_filename": null, "region_type": "private_memory", "start_va": 13762560, "timestamp": "00:00:38.807", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000765-addr_0x0000000000d60000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_715", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 14024704, "type": "region", "version": 1 }, "end_va": 14028799, "entry_point": 0, "filename": null, "id": "region_765", "name": "private_0x0000000000d60000", "norm_filename": null, "region_type": "private_memory", "start_va": 14024704, "timestamp": "00:00:38.807", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000766-addr_0x0000000000d80000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_716", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 14155776, "type": "region", "version": 1 }, "end_va": 14417919, "entry_point": 0, "filename": null, "id": "region_766", "name": "private_0x0000000000d80000", "norm_filename": null, "region_type": "private_memory", "start_va": 14155776, "timestamp": "00:00:38.807", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000767-addr_0x0000000000dc0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_717", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 14417920, "type": "region", "version": 1 }, "end_va": 14680063, "entry_point": 0, "filename": null, "id": "region_767", "name": "private_0x0000000000dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 14417920, "timestamp": "00:00:38.808", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000768-addr_0x0000000000e00000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_718", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 14680064, "type": "region", "version": 1 }, "end_va": 14684159, "entry_point": 0, "filename": null, "id": "region_768", "name": "private_0x0000000000e00000", "norm_filename": null, "region_type": "private_memory", "start_va": 14680064, "timestamp": "00:00:38.808", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 16252928, "type": "region", "version": 1 }, "end_va": 17858559, "entry_point": 0, "filename": null, "id": "region_769", "name": "pagefile_0x0000000000f80000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 16252928, "timestamp": "00:00:38.808", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000770-addr_0x0000000001140000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_719", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 18087936, "type": "region", "version": 1 }, "end_va": 18153471, "entry_point": 0, "filename": null, "id": "region_770", "name": "private_0x0000000001140000", "norm_filename": null, "region_type": "private_memory", "start_va": 18087936, "timestamp": "00:00:38.808", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 86966272, "type": "region", "version": 1 }, "end_va": 88543231, "entry_point": 0, "filename": null, "id": "region_771", "name": "pagefile_0x00000000052f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86966272, "timestamp": "00:00:38.808", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 88604672, "type": "region", "version": 1 }, "end_va": 109576191, "entry_point": 0, "filename": null, "id": "region_772", "name": "pagefile_0x0000000005480000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 88604672, "timestamp": "00:00:38.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 109576192, "type": "region", "version": 1 }, "end_va": 112947199, "entry_point": 109576192, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_773", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 109576192, "timestamp": "00:00:38.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1931214848, "type": "region", "version": 1 }, "end_va": 1931255807, "entry_point": 1931214848, "filename": "\\Windows\\SysWOW64\\netutils.dll", "id": "region_774", "name": "netutils.dll", "norm_filename": "c:\\windows\\syswow64\\netutils.dll", "region_type": "memory_mapped_file", "start_va": 1931214848, "timestamp": "00:00:38.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 114688, "start_va": 1931804672, "type": "region", "version": 1 }, "end_va": 1931919359, "entry_point": 1931804672, "filename": "\\Windows\\SysWOW64\\srvcli.dll", "id": "region_775", "name": "srvcli.dll", "norm_filename": "c:\\windows\\syswow64\\srvcli.dll", "region_type": "memory_mapped_file", "start_va": 1931804672, "timestamp": "00:00:38.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1306624, "start_va": 1931935744, "type": "region", "version": 1 }, "end_va": 1933242367, "entry_point": 1931935744, "filename": "\\Windows\\SysWOW64\\dbghelp.dll", "id": "region_776", "name": "dbghelp.dll", "norm_filename": "c:\\windows\\syswow64\\dbghelp.dll", "region_type": "memory_mapped_file", "start_va": 1931935744, "timestamp": "00:00:38.810", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 258048, "start_va": 1933246464, "type": "region", "version": 1 }, "end_va": 1933504511, "entry_point": 1933246464, "filename": "\\Windows\\SysWOW64\\framedynos.dll", "id": "region_777", "name": "framedynos.dll", "norm_filename": "c:\\windows\\syswow64\\framedynos.dll", "region_type": "memory_mapped_file", "start_va": 1933246464, "timestamp": "00:00:38.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 94208, "start_va": 1933508608, "type": "region", "version": 1 }, "end_va": 1933602815, "entry_point": 1933508608, "filename": "\\Windows\\SysWOW64\\mpr.dll", "id": "region_778", "name": "mpr.dll", "norm_filename": "c:\\windows\\syswow64\\mpr.dll", "region_type": "memory_mapped_file", "start_va": 1933508608, "timestamp": "00:00:38.819", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1943339008, "type": "region", "version": 1 }, "end_va": 1943371775, "entry_point": 1943339008, "filename": "\\Windows\\SysWOW64\\version.dll", "id": "region_779", "name": "version.dll", "norm_filename": "c:\\windows\\syswow64\\version.dll", "region_type": "memory_mapped_file", "start_va": 1943339008, "timestamp": "00:00:38.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1948450816, "type": "region", "version": 1 }, "end_va": 1948815359, "entry_point": 1948450816, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_780", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1948450816, "timestamp": "00:00:38.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1948844032, "type": "region", "version": 1 }, "end_va": 1948884991, "entry_point": 1948844032, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_781", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1948844032, "timestamp": "00:00:38.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1948909568, "type": "region", "version": 1 }, "end_va": 1949032447, "entry_point": 1948909568, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_782", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1948909568, "timestamp": "00:00:38.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1310720, "start_va": 1951399936, "type": "region", "version": 1 }, "end_va": 1952710655, "entry_point": 1951399936, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_783", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1951399936, "timestamp": "00:00:38.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1953693696, "type": "region", "version": 1 }, "end_va": 1953869823, "entry_point": 1953693696, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_784", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1953693696, "timestamp": "00:00:38.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1974992896, "type": "region", "version": 1 }, "end_va": 1975771135, "entry_point": 1974992896, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_785", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1974992896, "timestamp": "00:00:38.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1976827904, "type": "region", "version": 1 }, "end_va": 1977331711, "entry_point": 1976827904, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_786", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1976827904, "timestamp": "00:00:38.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1977352192, "type": "region", "version": 1 }, "end_va": 1977630719, "entry_point": 1977352192, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_787", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1977352192, "timestamp": "00:00:38.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1978073088, "type": "region", "version": 1 }, "end_va": 1978777599, "entry_point": 1978073088, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_788", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1978073088, "timestamp": "00:00:38.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1978793984, "type": "region", "version": 1 }, "end_va": 1980325887, "entry_point": 1978793984, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_789", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1978793984, "timestamp": "00:00:38.821", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1980366848, "type": "region", "version": 1 }, "end_va": 1980641279, "entry_point": 1980366848, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_790", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1980366848, "timestamp": "00:00:38.821", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 1983578112, "type": "region", "version": 1 }, "end_va": 1984176127, "entry_point": 1983578112, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_791", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 1983578112, "timestamp": "00:00:38.821", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 376832, "start_va": 1984364544, "type": "region", "version": 1 }, "end_va": 1984741375, "entry_point": 1984364544, "filename": "\\Windows\\SysWOW64\\ws2_32.dll", "id": "region_792", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\syswow64\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 1984364544, "timestamp": "00:00:38.821", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1363968, "start_va": 1989869568, "type": "region", "version": 1 }, "end_va": 1991233535, "entry_point": 1989869568, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_793", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1989869568, "timestamp": "00:00:38.823", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1992032256, "type": "region", "version": 1 }, "end_va": 1993015295, "entry_point": 1992032256, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_794", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1992032256, "timestamp": "00:00:38.823", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1810432, "start_va": 1993277440, "type": "region", "version": 1 }, "end_va": 1995087871, "entry_point": 1993277440, "filename": "\\Windows\\SysWOW64\\combase.dll", "id": "region_795", "name": "combase.dll", "norm_filename": "c:\\windows\\syswow64\\combase.dll", "region_type": "memory_mapped_file", "start_va": 1993277440, "timestamp": "00:00:38.823", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 1996750848, "type": "region", "version": 1 }, "end_va": 1996779519, "entry_point": 1996750848, "filename": "\\Windows\\SysWOW64\\nsi.dll", "id": "region_796", "name": "nsi.dll", "norm_filename": "c:\\windows\\syswow64\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 1996750848, "timestamp": "00:00:38.823", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1179648, "start_va": 1996947456, "type": "region", "version": 1 }, "end_va": 1998127103, "entry_point": 1996947456, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_797", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1996947456, "timestamp": "00:00:38.823", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2125398016, "type": "region", "version": 1 }, "end_va": 2126446591, "entry_point": 0, "filename": null, "id": "region_798", "name": "pagefile_0x000000007eaf0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2125398016, "timestamp": "00:00:38.823", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000799-addr_0x000000007ec16000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_720", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2126602240, "type": "region", "version": 1 }, "end_va": 2126614527, "entry_point": 0, "filename": null, "id": "region_799", "name": "private_0x000000007ec16000", "norm_filename": null, "region_type": "private_memory", "start_va": 2126602240, "timestamp": "00:00:38.824", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000800-addr_0x000000007ec19000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_721", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2126614528, "type": "region", "version": 1 }, "end_va": 2126626815, "entry_point": 0, "filename": null, "id": "region_800", "name": "private_0x000000007ec19000", "norm_filename": null, "region_type": "private_memory", "start_va": 2126614528, "timestamp": "00:00:38.824", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000801-addr_0x0000000000e10000-size_0x0000000000004000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_722", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 16384, "start_va": 14745600, "type": "region", "version": 1 }, "end_va": 14761983, "entry_point": 0, "filename": null, "id": "region_801", "name": "private_0x0000000000e10000", "norm_filename": null, "region_type": "private_memory", "start_va": 14745600, "timestamp": "00:00:40.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 14811136, "type": "region", "version": 1 }, "end_va": 14815231, "entry_point": 0, "filename": null, "id": "region_802", "name": "pagefile_0x0000000000e20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 14811136, "timestamp": "00:00:40.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 14876672, "type": "region", "version": 1 }, "end_va": 14880767, "entry_point": 0, "filename": null, "id": "region_803", "name": "pagefile_0x0000000000e30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 14876672, "timestamp": "00:00:40.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 18153472, "type": "region", "version": 1 }, "end_va": 19066879, "entry_point": 18153472, "filename": "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui", "id": "region_804", "name": "kernelbase.dll.mui", "norm_filename": "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui", "region_type": "memory_mapped_file", "start_va": 18153472, "timestamp": "00:00:40.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 417792, "start_va": 1930690560, "type": "region", "version": 1 }, "end_va": 1931108351, "entry_point": 1930690560, "filename": "\\Windows\\SysWOW64\\wbemcomn.dll", "id": "region_805", "name": "wbemcomn.dll", "norm_filename": "c:\\windows\\syswow64\\wbemcomn.dll", "region_type": "memory_mapped_file", "start_va": 1930690560, "timestamp": "00:00:40.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 53248, "start_va": 1931149312, "type": "region", "version": 1 }, "end_va": 1931202559, "entry_point": 1931149312, "filename": "\\Windows\\SysWOW64\\wbem\\wbemprox.dll", "id": "region_806", "name": "wbemprox.dll", "norm_filename": "c:\\windows\\syswow64\\wbem\\wbemprox.dll", "region_type": "memory_mapped_file", "start_va": 1931149312, "timestamp": "00:00:40.893", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 110592, "start_va": 1936588800, "type": "region", "version": 1 }, "end_va": 1936699391, "entry_point": 1936588800, "filename": "\\Windows\\SysWOW64\\bcrypt.dll", "id": "region_807", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\syswow64\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 1936588800, "timestamp": "00:00:40.894", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 532480, "start_va": 1949040640, "type": "region", "version": 1 }, "end_va": 1949573119, "entry_point": 1949040640, "filename": "\\Windows\\SysWOW64\\clbcatq.dll", "id": "region_808", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\syswow64\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 1949040640, "timestamp": "00:00:40.894", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1995112448, "type": "region", "version": 1 }, "end_va": 1995161599, "entry_point": 1995112448, "filename": "\\Windows\\SysWOW64\\kernel.appcore.dll", "id": "region_809", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\syswow64\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 1995112448, "timestamp": "00:00:40.894", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1930362880, "type": "region", "version": 1 }, "end_va": 1930641407, "entry_point": 1930362880, "filename": "\\Windows\\SysWOW64\\winsta.dll", "id": "region_810", "name": "winsta.dll", "norm_filename": "c:\\windows\\syswow64\\winsta.dll", "region_type": "memory_mapped_file", "start_va": 1930362880, "timestamp": "00:00:41.217", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000811-addr_0x0000000000e40000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_723", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 14942208, "type": "region", "version": 1 }, "end_va": 15204351, "entry_point": 0, "filename": null, "id": "region_811", "name": "private_0x0000000000e40000", "norm_filename": null, "region_type": "private_memory", "start_va": 14942208, "timestamp": "00:00:41.896", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000812-addr_0x0000000001230000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_724", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 19070976, "type": "region", "version": 1 }, "end_va": 19333119, "entry_point": 0, "filename": null, "id": "region_812", "name": "private_0x0000000001230000", "norm_filename": null, "region_type": "private_memory", "start_va": 19070976, "timestamp": "00:00:41.896", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000813-addr_0x0000000001270000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_725", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 19333120, "type": "region", "version": 1 }, "end_va": 19595263, "entry_point": 0, "filename": null, "id": "region_813", "name": "private_0x0000000001270000", "norm_filename": null, "region_type": "private_memory", "start_va": 19333120, "timestamp": "00:00:41.896", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000814-addr_0x0000000006bc0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_726", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 112984064, "type": "region", "version": 1 }, "end_va": 113246207, "entry_point": 0, "filename": null, "id": "region_814", "name": "private_0x0000000006bc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 112984064, "timestamp": "00:00:41.896", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000815-addr_0x0000000006c00000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_727", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 113246208, "type": "region", "version": 1 }, "end_va": 113508351, "entry_point": 0, "filename": null, "id": "region_815", "name": "private_0x0000000006c00000", "norm_filename": null, "region_type": "private_memory", "start_va": 113246208, "timestamp": "00:00:41.897", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000816-addr_0x0000000006c40000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_728", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 113508352, "type": "region", "version": 1 }, "end_va": 113770495, "entry_point": 0, "filename": null, "id": "region_816", "name": "private_0x0000000006c40000", "norm_filename": null, "region_type": "private_memory", "start_va": 113508352, "timestamp": "00:00:41.897", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 69632, "start_va": 1930231808, "type": "region", "version": 1 }, "end_va": 1930301439, "entry_point": 1930231808, "filename": "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll", "id": "region_817", "name": "wbemsvc.dll", "norm_filename": "c:\\windows\\syswow64\\wbem\\wbemsvc.dll", "region_type": "memory_mapped_file", "start_va": 1930231808, "timestamp": "00:00:41.897", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 192512, "start_va": 1931476992, "type": "region", "version": 1 }, "end_va": 1931669503, "entry_point": 1931476992, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_818", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 1931476992, "timestamp": "00:00:41.898", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 1931673600, "type": "region", "version": 1 }, "end_va": 1931751423, "entry_point": 1931673600, "filename": "\\Windows\\SysWOW64\\cryptsp.dll", "id": "region_819", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\syswow64\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 1931673600, "timestamp": "00:00:41.898", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000820-addr_0x000000007eae7000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_729", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2125361152, "type": "region", "version": 1 }, "end_va": 2125373439, "entry_point": 0, "filename": null, "id": "region_820", "name": "private_0x000000007eae7000", "norm_filename": null, "region_type": "private_memory", "start_va": 2125361152, "timestamp": "00:00:41.899", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000821-addr_0x000000007eaea000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_730", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2125373440, "type": "region", "version": 1 }, "end_va": 2125385727, "entry_point": 0, "filename": null, "id": "region_821", "name": "private_0x000000007eaea000", "norm_filename": null, "region_type": "private_memory", "start_va": 2125373440, "timestamp": "00:00:41.899", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000822-addr_0x000000007eaed000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_731", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2125385728, "type": "region", "version": 1 }, "end_va": 2125398015, "entry_point": 0, "filename": null, "id": "region_822", "name": "private_0x000000007eaed000", "norm_filename": null, "region_type": "private_memory", "start_va": 2125385728, "timestamp": "00:00:41.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 770048, "start_va": 1929445376, "type": "region", "version": 1 }, "end_va": 1930215423, "entry_point": 1929445376, "filename": "\\Windows\\SysWOW64\\wbem\\fastprox.dll", "id": "region_1286", "name": "fastprox.dll", "norm_filename": "c:\\windows\\syswow64\\wbem\\fastprox.dll", "region_type": "memory_mapped_file", "start_va": 1929445376, "timestamp": "00:00:42.421", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1929314304, "type": "region", "version": 1 }, "end_va": 1929437183, "entry_point": 1929314304, "filename": "\\Windows\\SysWOW64\\wbem\\wmiutils.dll", "id": "region_1287", "name": "wmiutils.dll", "norm_filename": "c:\\windows\\syswow64\\wbem\\wmiutils.dll", "region_type": "memory_mapped_file", "start_va": 1929314304, "timestamp": "00:00:43.972", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vwOrbzLbc.exe\" ", "filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vworbzlbc.exe", "id": "proc_11", "image_name": "vworbzlbc.exe", "monitor_reason": "autostart", "monitored_id": 11, "origin_monitor_id": 0, "ref_parent_process": null, "regions": [ { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_1459", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:01:49.234", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_1460", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:01:49.234", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 344063, "entry_point": 0, "filename": null, "id": "region_1461", "name": "pagefile_0x0000000000040000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 262144, "timestamp": "00:01:49.234", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 393216, "type": "region", "version": 1 }, "end_va": 655359, "entry_point": 0, "filename": null, "id": "region_1462", "name": "private_0x0000000000060000", "norm_filename": null, "region_type": "private_memory", "start_va": 393216, "timestamp": "00:01:49.234", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 655360, "type": "region", "version": 1 }, "end_va": 1703935, "entry_point": 0, "filename": null, "id": "region_1463", "name": "private_0x00000000000a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 655360, "timestamp": "00:01:49.235", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 245760, "start_va": 4194304, "type": "region", "version": 1 }, "end_va": 4440063, "entry_point": 4194304, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vwOrbzLbc.exe", "id": "region_1464", "name": "vworbzlbc.exe", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vworbzlbc.exe", "region_type": "memory_mapped_file", "start_va": 4194304, "timestamp": "00:01:49.235", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1997078528, "type": "region", "version": 1 }, "end_va": 1998622719, "entry_point": 1997078528, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_1465", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1997078528, "timestamp": "00:01:49.337", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2147155968, "type": "region", "version": 1 }, "end_va": 2147299327, "entry_point": 0, "filename": null, "id": "region_1466", "name": "pagefile_0x000000007ffb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2147155968, "timestamp": "00:01:49.337", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2147332096, "type": "region", "version": 1 }, "end_va": 2147344383, "entry_point": 0, "filename": null, "id": "region_1467", "name": "private_0x000000007ffdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147332096, "timestamp": "00:01:49.337", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2147344384, "type": "region", "version": 1 }, "end_va": 2147348479, "entry_point": 0, "filename": null, "id": "region_1468", "name": "private_0x000000007ffde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147344384, "timestamp": "00:01:49.337", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2147348480, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_1469", "name": "private_0x000000007ffdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147348480, "timestamp": "00:01:49.337", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_1470", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:49.338", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 140732238200832, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 140734385618943, "entry_point": 0, "filename": null, "id": "region_1471", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:01:49.338", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140734385618944, "type": "region", "version": 1 }, "end_va": 140734387462143, "entry_point": 140734385618944, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_1472", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140734385618944, "timestamp": "00:01:49.338", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3100827648, "start_va": 140734387462144, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_1473", "name": "private_0x00007fff472c2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140734387462144, "timestamp": "00:01:49.338", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 1703936, "type": "region", "version": 1 }, "end_va": 1720319, "entry_point": 0, "filename": null, "id": "region_1619", "name": "pagefile_0x00000000001a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1703936, "timestamp": "00:01:49.488", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1769472, "type": "region", "version": 1 }, "end_va": 1777663, "entry_point": 0, "filename": null, "id": "region_1620", "name": "pagefile_0x00000000001b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1769472, "timestamp": "00:01:49.488", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 1835008, "type": "region", "version": 1 }, "end_va": 1843199, "entry_point": 0, "filename": null, "id": "region_1621", "name": "private_0x00000000001c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1835008, "timestamp": "00:01:49.489", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 2686976, "type": "region", "version": 1 }, "end_va": 2752511, "entry_point": 0, "filename": null, "id": "region_1622", "name": "private_0x0000000000290000", "norm_filename": null, "region_type": "private_memory", "start_va": 2686976, "timestamp": "00:01:49.489", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1988624384, "type": "region", "version": 1 }, "end_va": 1988947967, "entry_point": 1988624384, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_1623", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1988624384, "timestamp": "00:01:49.489", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1988952064, "type": "region", "version": 1 }, "end_va": 1989423103, "entry_point": 1988952064, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_1624", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1988952064, "timestamp": "00:01:49.489", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1988558848, "type": "region", "version": 1 }, "end_va": 1988591615, "entry_point": 1988558848, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_1625", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1988558848, "timestamp": "00:01:49.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 5636096, "type": "region", "version": 1 }, "end_va": 6684671, "entry_point": 0, "filename": null, "id": "region_1626", "name": "private_0x0000000000560000", "norm_filename": null, "region_type": "private_memory", "start_va": 5636096, "timestamp": "00:01:49.502", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1953431552, "type": "region", "version": 1 }, "end_va": 1954963455, "entry_point": 1953431552, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_1627", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1953431552, "timestamp": "00:01:49.502", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1982464000, "type": "region", "version": 1 }, "end_va": 1983447039, "entry_point": 1982464000, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_1628", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1982464000, "timestamp": "00:01:49.503", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_1629", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:01:49.532", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 147455, "entry_point": 0, "filename": null, "id": "region_1630", "name": "private_0x0000000000020000", "norm_filename": null, "region_type": "private_memory", "start_va": 131072, "timestamp": "00:01:49.532", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 1900544, "type": "region", "version": 1 }, "end_va": 2678783, "entry_point": 1900544, "filename": "\\Windows\\System32\\locale.nls", "id": "region_1631", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 1900544, "timestamp": "00:01:49.532", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 3014655, "entry_point": 0, "filename": null, "id": "region_1632", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:01:49.533", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 3014656, "type": "region", "version": 1 }, "end_va": 4063231, "entry_point": 0, "filename": null, "id": "region_1633", "name": "private_0x00000000002e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3014656, "timestamp": "00:01:49.533", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2134016, "start_va": 1944322048, "type": "region", "version": 1 }, "end_va": 1946456063, "entry_point": 1944322048, "filename": "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll", "id": "region_1634", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 1944322048, "timestamp": "00:01:49.533", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1946484736, "type": "region", "version": 1 }, "end_va": 1946849279, "entry_point": 1946484736, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_1635", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1946484736, "timestamp": "00:01:49.533", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1946877952, "type": "region", "version": 1 }, "end_va": 1946918911, "entry_point": 1946877952, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_1636", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1946877952, "timestamp": "00:01:49.533", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1946943488, "type": "region", "version": 1 }, "end_va": 1947066367, "entry_point": 1946943488, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_1637", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1946943488, "timestamp": "00:01:49.533", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1947205632, "type": "region", "version": 1 }, "end_va": 1947484159, "entry_point": 1947205632, "filename": "\\Windows\\SysWOW64\\powrprof.dll", "id": "region_1638", "name": "powrprof.dll", "norm_filename": "c:\\windows\\syswow64\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 1947205632, "timestamp": "00:01:49.533", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 577536, "start_va": 1949761536, "type": "region", "version": 1 }, "end_va": 1950339071, "entry_point": 1949761536, "filename": "\\Windows\\SysWOW64\\SHCore.dll", "id": "region_1639", "name": "shcore.dll", "norm_filename": "c:\\windows\\syswow64\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 1949761536, "timestamp": "00:01:49.533", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1951006720, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951006720, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_1640", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1951006720, "timestamp": "00:01:49.533", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1951793152, "type": "region", "version": 1 }, "end_va": 1952067583, "entry_point": 1951793152, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_1641", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1951793152, "timestamp": "00:01:49.534", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1953366016, "type": "region", "version": 1 }, "end_va": 1953415167, "entry_point": 1953366016, "filename": "\\Windows\\SysWOW64\\kernel.appcore.dll", "id": "region_1642", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\syswow64\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 1953366016, "timestamp": "00:01:49.534", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1956511744, "type": "region", "version": 1 }, "end_va": 1957216255, "entry_point": 1956511744, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_1643", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1956511744, "timestamp": "00:01:49.534", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 958464, "start_va": 1957232640, "type": "region", "version": 1 }, "end_va": 1958191103, "entry_point": 1957232640, "filename": "\\Windows\\SysWOW64\\ole32.dll", "id": "region_1644", "name": "ole32.dll", "norm_filename": "c:\\windows\\syswow64\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1957232640, "timestamp": "00:01:49.534", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20705280, "start_va": 1958805504, "type": "region", "version": 1 }, "end_va": 1979510783, "entry_point": 1958805504, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_1645", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1958805504, "timestamp": "00:01:49.534", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1810432, "start_va": 1979973632, "type": "region", "version": 1 }, "end_va": 1981784063, "entry_point": 1979973632, "filename": "\\Windows\\SysWOW64\\combase.dll", "id": "region_1646", "name": "combase.dll", "norm_filename": "c:\\windows\\syswow64\\combase.dll", "region_type": "memory_mapped_file", "start_va": 1979973632, "timestamp": "00:01:49.534", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 5099520, "start_va": 1983447040, "type": "region", "version": 1 }, "end_va": 1988546559, "entry_point": 1983447040, "filename": "\\Windows\\SysWOW64\\windows.storage.dll", "id": "region_1647", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\syswow64\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 1983447040, "timestamp": "00:01:49.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1310720, "start_va": 1989541888, "type": "region", "version": 1 }, "end_va": 1990852607, "entry_point": 1989541888, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_1648", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1989541888, "timestamp": "00:01:49.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 1991049216, "type": "region", "version": 1 }, "end_va": 1991110655, "entry_point": 1991049216, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_1649", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1991049216, "timestamp": "00:01:49.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1992294400, "type": "region", "version": 1 }, "end_va": 1992572927, "entry_point": 1992294400, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_1650", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1992294400, "timestamp": "00:01:49.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1992622080, "type": "region", "version": 1 }, "end_va": 1993125887, "entry_point": 1992622080, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_1651", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1992622080, "timestamp": "00:01:49.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1363968, "start_va": 1995702272, "type": "region", "version": 1 }, "end_va": 1997066239, "entry_point": 1995702272, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_1652", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1995702272, "timestamp": "00:01:49.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2146107392, "type": "region", "version": 1 }, "end_va": 2147155967, "entry_point": 0, "filename": null, "id": "region_1653", "name": "pagefile_0x000000007feb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2146107392, "timestamp": "00:01:49.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2147319808, "type": "region", "version": 1 }, "end_va": 2147332095, "entry_point": 0, "filename": null, "id": "region_1654", "name": "private_0x000000007ffd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147319808, "timestamp": "00:01:49.535", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 5308416, "type": "region", "version": 1 }, "end_va": 5373951, "entry_point": 0, "filename": null, "id": "region_1655", "name": "private_0x0000000000510000", "norm_filename": null, "region_type": "private_memory", "start_va": 5308416, "timestamp": "00:01:49.540", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 6684672, "type": "region", "version": 1 }, "end_va": 8290303, "entry_point": 0, "filename": null, "id": "region_1656", "name": "pagefile_0x0000000000660000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6684672, "timestamp": "00:01:49.540", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1179648, "start_va": 1952120832, "type": "region", "version": 1 }, "end_va": 1953300479, "entry_point": 1952120832, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_1657", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1952120832, "timestamp": "00:01:49.540", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1990852608, "type": "region", "version": 1 }, "end_va": 1991028735, "entry_point": 1990852608, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_1658", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1990852608, "timestamp": "00:01:49.540", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 200703, "entry_point": 0, "filename": null, "id": "region_1659", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:01:49.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 4063232, "type": "region", "version": 1 }, "end_va": 4067327, "entry_point": 0, "filename": null, "id": "region_1660", "name": "private_0x00000000003e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 4063232, "timestamp": "00:01:49.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 4456448, "type": "region", "version": 1 }, "end_va": 4464639, "entry_point": 0, "filename": null, "id": "region_1661", "name": "pagefile_0x0000000000440000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4456448, "timestamp": "00:01:49.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 8323072, "type": "region", "version": 1 }, "end_va": 9900031, "entry_point": 0, "filename": null, "id": "region_1662", "name": "pagefile_0x00000000007f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8323072, "timestamp": "00:01:49.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 9961472, "type": "region", "version": 1 }, "end_va": 30932991, "entry_point": 0, "filename": null, "id": "region_1663", "name": "pagefile_0x0000000000980000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 9961472, "timestamp": "00:01:49.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 479232, "start_va": 1943797760, "type": "region", "version": 1 }, "end_va": 1944276991, "entry_point": 1943797760, "filename": "\\Windows\\SysWOW64\\uxtheme.dll", "id": "region_1664", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\syswow64\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 1943797760, "timestamp": "00:01:49.563", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 458752, "start_va": 4521984, "type": "region", "version": 1 }, "end_va": 4980735, "entry_point": 0, "filename": null, "id": "region_1665", "name": "private_0x0000000000450000", "norm_filename": null, "region_type": "private_memory", "start_va": 4521984, "timestamp": "00:01:49.566", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 102400, "start_va": 1943666688, "type": "region", "version": 1 }, "end_va": 1943769087, "entry_point": 1943666688, "filename": "\\Windows\\SysWOW64\\userenv.dll", "id": "region_1666", "name": "userenv.dll", "norm_filename": "c:\\windows\\syswow64\\userenv.dll", "region_type": "memory_mapped_file", "start_va": 1943666688, "timestamp": "00:01:49.572", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1724416, "start_va": 1993146368, "type": "region", "version": 1 }, "end_va": 1994870783, "entry_point": 1993146368, "filename": "\\Windows\\SysWOW64\\setupapi.dll", "id": "region_1667", "name": "setupapi.dll", "norm_filename": "c:\\windows\\syswow64\\setupapi.dll", "region_type": "memory_mapped_file", "start_va": 1993146368, "timestamp": "00:01:49.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 1958543360, "type": "region", "version": 1 }, "end_va": 1958764543, "entry_point": 1958543360, "filename": "\\Windows\\SysWOW64\\cfgmgr32.dll", "id": "region_1668", "name": "cfgmgr32.dll", "norm_filename": "c:\\windows\\syswow64\\cfgmgr32.dll", "region_type": "memory_mapped_file", "start_va": 1958543360, "timestamp": "00:01:49.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 593920, "start_va": 1943011328, "type": "region", "version": 1 }, "end_va": 1943605247, "entry_point": 1943011328, "filename": "\\Windows\\SysWOW64\\apphelp.dll", "id": "region_1669", "name": "apphelp.dll", "norm_filename": "c:\\windows\\syswow64\\apphelp.dll", "region_type": "memory_mapped_file", "start_va": 1943011328, "timestamp": "00:01:49.580", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1318912, "start_va": 1941635072, "type": "region", "version": 1 }, "end_va": 1942953983, "entry_point": 1941635072, "filename": "\\Windows\\SysWOW64\\propsys.dll", "id": "region_1670", "name": "propsys.dll", "norm_filename": "c:\\windows\\syswow64\\propsys.dll", "region_type": "memory_mapped_file", "start_va": 1941635072, "timestamp": "00:01:49.586", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 1947533312, "type": "region", "version": 1 }, "end_va": 1948131327, "entry_point": 1947533312, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_1671", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 1947533312, "timestamp": "00:01:49.586", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 118784, "start_va": 1941504000, "type": "region", "version": 1 }, "end_va": 1941622783, "entry_point": 1941504000, "filename": "\\Windows\\SysWOW64\\dwmapi.dll", "id": "region_1672", "name": "dwmapi.dll", "norm_filename": "c:\\windows\\syswow64\\dwmapi.dll", "region_type": "memory_mapped_file", "start_va": 1941504000, "timestamp": "00:01:49.603", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 339968, "start_va": 1941110784, "type": "region", "version": 1 }, "end_va": 1941450751, "entry_point": 1941110784, "filename": "\\Windows\\SysWOW64\\oleacc.dll", "id": "region_1673", "name": "oleacc.dll", "norm_filename": "c:\\windows\\syswow64\\oleacc.dll", "region_type": "memory_mapped_file", "start_va": 1941110784, "timestamp": "00:01:49.612", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 4128768, "type": "region", "version": 1 }, "end_va": 4136959, "entry_point": 4128768, "filename": "\\Windows\\SysWOW64\\oleaccrc.dll", "id": "region_1674", "name": "oleaccrc.dll", "norm_filename": "c:\\windows\\syswow64\\oleaccrc.dll", "region_type": "memory_mapped_file", "start_va": 4128768, "timestamp": "00:01:49.620", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 532480, "start_va": 1950416896, "type": "region", "version": 1 }, "end_va": 1950949375, "entry_point": 1950416896, "filename": "\\Windows\\SysWOW64\\clbcatq.dll", "id": "region_1675", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\syswow64\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 1950416896, "timestamp": "00:01:49.621", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1941045248, "type": "region", "version": 1 }, "end_va": 1941078015, "entry_point": 1941045248, "filename": "\\Windows\\SysWOW64\\version.dll", "id": "region_1676", "name": "version.dll", "norm_filename": "c:\\windows\\syswow64\\version.dll", "region_type": "memory_mapped_file", "start_va": 1941045248, "timestamp": "00:01:49.628", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 1940979712, "type": "region", "version": 1 }, "end_va": 1941004287, "entry_point": 1940979712, "filename": "\\Windows\\SysWOW64\\shfolder.dll", "id": "region_1677", "name": "shfolder.dll", "norm_filename": "c:\\windows\\syswow64\\shfolder.dll", "region_type": "memory_mapped_file", "start_va": 1940979712, "timestamp": "00:01:49.632", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 4521984, "type": "region", "version": 1 }, "end_va": 4538367, "entry_point": 0, "filename": null, "id": "region_1678", "name": "private_0x0000000000450000", "norm_filename": null, "region_type": "private_memory", "start_va": 4521984, "timestamp": "00:01:49.633", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 4915200, "type": "region", "version": 1 }, "end_va": 4980735, "entry_point": 0, "filename": null, "id": "region_1679", "name": "private_0x00000000004b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 4915200, "timestamp": "00:01:49.634", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 4587520, "type": "region", "version": 1 }, "end_va": 4591615, "entry_point": 0, "filename": null, "id": "region_1680", "name": "pagefile_0x0000000000460000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4587520, "timestamp": "00:01:49.644", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 30932992, "type": "region", "version": 1 }, "end_va": 34303999, "entry_point": 30932992, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_1681", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 30932992, "timestamp": "00:01:49.645", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 4653056, "type": "region", "version": 1 }, "end_va": 4915199, "entry_point": 0, "filename": null, "id": "region_1682", "name": "private_0x0000000000470000", "norm_filename": null, "region_type": "private_memory", "start_va": 4653056, "timestamp": "00:01:49.670", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 4980736, "type": "region", "version": 1 }, "end_va": 4984831, "entry_point": 0, "filename": null, "id": "region_1683", "name": "pagefile_0x00000000004c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4980736, "timestamp": "00:01:49.670", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 34340864, "type": "region", "version": 1 }, "end_va": 35389439, "entry_point": 0, "filename": null, "id": "region_1684", "name": "private_0x00000000020c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 34340864, "timestamp": "00:01:49.670", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2147307520, "type": "region", "version": 1 }, "end_va": 2147319807, "entry_point": 0, "filename": null, "id": "region_1685", "name": "private_0x000000007ffd5000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147307520, "timestamp": "00:01:49.670", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 5046272, "type": "region", "version": 1 }, "end_va": 5050367, "entry_point": 0, "filename": null, "id": "region_1686", "name": "pagefile_0x00000000004d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5046272, "timestamp": "00:01:49.671", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 5111808, "type": "region", "version": 1 }, "end_va": 5128191, "entry_point": 5111808, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "id": "region_1687", "name": "cversions.1.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db", "region_type": "memory_mapped_file", "start_va": 5111808, "timestamp": "00:01:49.674", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 102400, "start_va": 5177344, "type": "region", "version": 1 }, "end_va": 5279743, "entry_point": 5177344, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db", "id": "region_1688", "name": "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db", "region_type": "memory_mapped_file", "start_va": 5177344, "timestamp": "00:01:49.675", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 5373952, "type": "region", "version": 1 }, "end_va": 5378047, "entry_point": 0, "filename": null, "id": "region_1689", "name": "pagefile_0x0000000000520000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5373952, "timestamp": "00:01:49.676", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 35389440, "type": "region", "version": 1 }, "end_va": 35651583, "entry_point": 0, "filename": null, "id": "region_1690", "name": "private_0x00000000021c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 35389440, "timestamp": "00:01:49.685", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 35651584, "type": "region", "version": 1 }, "end_va": 36700159, "entry_point": 0, "filename": null, "id": "region_1691", "name": "private_0x0000000002200000", "norm_filename": null, "region_type": "private_memory", "start_va": 35651584, "timestamp": "00:01:49.685", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2146095104, "type": "region", "version": 1 }, "end_va": 2146107391, "entry_point": 0, "filename": null, "id": "region_1692", "name": "private_0x000000007fead000", "norm_filename": null, "region_type": "private_memory", "start_va": 2146095104, "timestamp": "00:01:49.685", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8421376, "start_va": 36700160, "type": "region", "version": 1 }, "end_va": 45121535, "entry_point": 0, "filename": null, "id": "region_1693", "name": "private_0x0000000002300000", "norm_filename": null, "region_type": "private_memory", "start_va": 36700160, "timestamp": "00:01:49.722", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 5111808, "type": "region", "version": 1 }, "end_va": 5124095, "entry_point": 0, "filename": null, "id": "region_1694", "name": "pagefile_0x00000000004e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5111808, "timestamp": "00:01:49.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 24576, "start_va": 268435456, "type": "region", "version": 1 }, "end_va": 268460031, "entry_point": 268435456, "filename": "\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\nss8BF6.tmp\\System.dll", "id": "region_1695", "name": "system.dll", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\nss8bf6.tmp\\system.dll", "region_type": "memory_mapped_file", "start_va": 268435456, "timestamp": "00:01:49.761", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 100024320, "start_va": 45154304, "type": "region", "version": 1 }, "end_va": 145178623, "entry_point": 0, "filename": null, "id": "region_1696", "name": "private_0x0000000002b10000", "norm_filename": null, "region_type": "private_memory", "start_va": 45154304, "timestamp": "00:01:49.768", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 73728, "start_va": 5439488, "type": "region", "version": 1 }, "end_va": 5513215, "entry_point": 0, "filename": null, "id": "region_1697", "name": "pagefile_0x0000000000530000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5439488, "timestamp": "00:01:50.019", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 1940848640, "type": "region", "version": 1 }, "end_va": 1940926463, "entry_point": 1940848640, "filename": "\\Windows\\SysWOW64\\cryptsp.dll", "id": "region_1698", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\syswow64\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 1940848640, "timestamp": "00:01:56.220", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 110592, "start_va": 1940717568, "type": "region", "version": 1 }, "end_va": 1940828159, "entry_point": 1940717568, "filename": "\\Windows\\SysWOW64\\bcrypt.dll", "id": "region_1699", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\syswow64\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 1940717568, "timestamp": "00:01:56.221", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 192512, "start_va": 1940520960, "type": "region", "version": 1 }, "end_va": 1940713471, "entry_point": 1940520960, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_1700", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 1940520960, "timestamp": "00:01:56.227", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 57344, "start_va": 5111808, "type": "region", "version": 1 }, "end_va": 5169151, "entry_point": 0, "filename": null, "id": "region_1701", "name": "private_0x00000000004e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 5111808, "timestamp": "00:01:56.272", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1536000, "start_va": 145227776, "type": "region", "version": 1 }, "end_va": 146763775, "entry_point": 0, "filename": null, "id": "region_1720", "name": "private_0x0000000008a80000", "norm_filename": null, "region_type": "private_memory", "start_va": 145227776, "timestamp": "00:01:56.286", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1544192, "start_va": 146800640, "type": "region", "version": 1 }, "end_va": 148344831, "entry_point": 0, "filename": null, "id": "region_1721", "name": "private_0x0000000008c00000", "norm_filename": null, "region_type": "private_memory", "start_va": 146800640, "timestamp": "00:01:56.305", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 5570560, "type": "region", "version": 1 }, "end_va": 5631999, "entry_point": 0, "filename": null, "id": "region_1729", "name": "pagefile_0x0000000000550000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5570560, "timestamp": "00:01:56.432", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vwOrbzLbc.exe\" ", "filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vworbzlbc.exe", "id": "proc_12", "image_name": "vworbzlbc.exe", "monitor_reason": "child_process", "monitored_id": 12, "origin_monitor_id": 11, "ref_parent_process": { "ref_id": "proc_11", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_1702", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_1703", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 344063, "entry_point": 0, "filename": null, "id": "region_1704", "name": "pagefile_0x0000000000040000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 262144, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 393216, "type": "region", "version": 1 }, "end_va": 655359, "entry_point": 0, "filename": null, "id": "region_1705", "name": "private_0x0000000000060000", "norm_filename": null, "region_type": "private_memory", "start_va": 393216, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 655360, "type": "region", "version": 1 }, "end_va": 1703935, "entry_point": 0, "filename": null, "id": "region_1706", "name": "private_0x00000000000a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 655360, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 1703936, "type": "region", "version": 1 }, "end_va": 1720319, "entry_point": 0, "filename": null, "id": "region_1707", "name": "pagefile_0x00000000001a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1703936, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1769472, "type": "region", "version": 1 }, "end_va": 1777663, "entry_point": 0, "filename": null, "id": "region_1708", "name": "pagefile_0x00000000001b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1769472, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 1835008, "type": "region", "version": 1 }, "end_va": 1843199, "entry_point": 0, "filename": null, "id": "region_1709", "name": "private_0x00000000001c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1835008, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 245760, "start_va": 4194304, "type": "region", "version": 1 }, "end_va": 4440063, "entry_point": 4194304, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vwOrbzLbc.exe", "id": "region_1710", "name": "vworbzlbc.exe", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vworbzlbc.exe", "region_type": "memory_mapped_file", "start_va": 4194304, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1997078528, "type": "region", "version": 1 }, "end_va": 1998622719, "entry_point": 1997078528, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_1711", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1997078528, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2147155968, "type": "region", "version": 1 }, "end_va": 2147299327, "entry_point": 0, "filename": null, "id": "region_1712", "name": "pagefile_0x000000007ffb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2147155968, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2147332096, "type": "region", "version": 1 }, "end_va": 2147344383, "entry_point": 0, "filename": null, "id": "region_1713", "name": "private_0x000000007ffdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147332096, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2147344384, "type": "region", "version": 1 }, "end_va": 2147348479, "entry_point": 0, "filename": null, "id": "region_1714", "name": "private_0x000000007ffde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147344384, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2147348480, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_1715", "name": "private_0x000000007ffdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147348480, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_1716", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 140732238200832, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 140734385618943, "entry_point": 0, "filename": null, "id": "region_1717", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140734385618944, "type": "region", "version": 1 }, "end_va": 140734387462143, "entry_point": 140734385618944, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_1718", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140734385618944, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3100827648, "start_va": 140734387462144, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_1719", "name": "private_0x00007fff472c2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140734387462144, "timestamp": "00:01:56.277", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 4194304, "type": "region", "version": 1 }, "end_va": 4255743, "entry_point": 0, "filename": null, "id": "region_1726", "name": "pagefile_0x0000000000400000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4194304, "timestamp": "00:01:56.401", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 3145728, "type": "region", "version": 1 }, "end_va": 3211263, "entry_point": 0, "filename": null, "id": "region_1734", "name": "private_0x0000000000300000", "norm_filename": null, "region_type": "private_memory", "start_va": 3145728, "timestamp": "00:01:56.501", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1988624384, "type": "region", "version": 1 }, "end_va": 1988947967, "entry_point": 1988624384, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_1735", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1988624384, "timestamp": "00:01:56.502", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1988952064, "type": "region", "version": 1 }, "end_va": 1989423103, "entry_point": 1988952064, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_1736", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1988952064, "timestamp": "00:01:56.502", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 5832704, "type": "region", "version": 1 }, "end_va": 6881279, "entry_point": 0, "filename": null, "id": "region_1737", "name": "private_0x0000000000590000", "norm_filename": null, "region_type": "private_memory", "start_va": 5832704, "timestamp": "00:01:56.508", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1988558848, "type": "region", "version": 1 }, "end_va": 1988591615, "entry_point": 1988558848, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_1738", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1988558848, "timestamp": "00:01:56.508", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_1741", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 147455, "entry_point": 0, "filename": null, "id": "region_1742", "name": "private_0x0000000000020000", "norm_filename": null, "region_type": "private_memory", "start_va": 131072, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 200703, "entry_point": 0, "filename": null, "id": "region_1743", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 1900544, "type": "region", "version": 1 }, "end_va": 2678783, "entry_point": 1900544, "filename": "\\Windows\\System32\\locale.nls", "id": "region_1744", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 1900544, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 2686976, "type": "region", "version": 1 }, "end_va": 2949119, "entry_point": 0, "filename": null, "id": "region_1745", "name": "private_0x0000000000290000", "norm_filename": null, "region_type": "private_memory", "start_va": 2686976, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2949120, "type": "region", "version": 1 }, "end_va": 2953215, "entry_point": 0, "filename": null, "id": "region_1746", "name": "private_0x00000000002d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2949120, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 3932160, "type": "region", "version": 1 }, "end_va": 3997695, "entry_point": 0, "filename": null, "id": "region_1747", "name": "private_0x00000000003c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3932160, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 4259840, "type": "region", "version": 1 }, "end_va": 5308415, "entry_point": 0, "filename": null, "id": "region_1748", "name": "private_0x0000000000410000", "norm_filename": null, "region_type": "private_memory", "start_va": 4259840, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 6881280, "type": "region", "version": 1 }, "end_va": 8486911, "entry_point": 0, "filename": null, "id": "region_1749", "name": "pagefile_0x0000000000690000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6881280, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 8519680, "type": "region", "version": 1 }, "end_va": 10096639, "entry_point": 0, "filename": null, "id": "region_1750", "name": "pagefile_0x0000000000820000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8519680, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 10158080, "type": "region", "version": 1 }, "end_va": 31129599, "entry_point": 0, "filename": null, "id": "region_1751", "name": "pagefile_0x00000000009b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10158080, "timestamp": "00:01:56.573", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1946484736, "type": "region", "version": 1 }, "end_va": 1946849279, "entry_point": 1946484736, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_1752", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1946484736, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1946877952, "type": "region", "version": 1 }, "end_va": 1946918911, "entry_point": 1946877952, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_1753", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1946877952, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1946943488, "type": "region", "version": 1 }, "end_va": 1947066367, "entry_point": 1946943488, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_1754", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1946943488, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1947205632, "type": "region", "version": 1 }, "end_va": 1947484159, "entry_point": 1947205632, "filename": "\\Windows\\SysWOW64\\powrprof.dll", "id": "region_1755", "name": "powrprof.dll", "norm_filename": "c:\\windows\\syswow64\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 1947205632, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 577536, "start_va": 1949761536, "type": "region", "version": 1 }, "end_va": 1950339071, "entry_point": 1949761536, "filename": "\\Windows\\SysWOW64\\SHCore.dll", "id": "region_1756", "name": "shcore.dll", "norm_filename": "c:\\windows\\syswow64\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 1949761536, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1951006720, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951006720, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_1757", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1951006720, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1951793152, "type": "region", "version": 1 }, "end_va": 1952067583, "entry_point": 1951793152, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_1758", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1951793152, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1179648, "start_va": 1952120832, "type": "region", "version": 1 }, "end_va": 1953300479, "entry_point": 1952120832, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_1759", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1952120832, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1953366016, "type": "region", "version": 1 }, "end_va": 1953415167, "entry_point": 1953366016, "filename": "\\Windows\\SysWOW64\\kernel.appcore.dll", "id": "region_1760", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\syswow64\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 1953366016, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1953431552, "type": "region", "version": 1 }, "end_va": 1954963455, "entry_point": 1953431552, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_1761", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1953431552, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1956511744, "type": "region", "version": 1 }, "end_va": 1957216255, "entry_point": 1956511744, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_1762", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1956511744, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20705280, "start_va": 1958805504, "type": "region", "version": 1 }, "end_va": 1979510783, "entry_point": 1958805504, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_1763", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1958805504, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1810432, "start_va": 1979973632, "type": "region", "version": 1 }, "end_va": 1981784063, "entry_point": 1979973632, "filename": "\\Windows\\SysWOW64\\combase.dll", "id": "region_1764", "name": "combase.dll", "norm_filename": "c:\\windows\\syswow64\\combase.dll", "region_type": "memory_mapped_file", "start_va": 1979973632, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1982464000, "type": "region", "version": 1 }, "end_va": 1983447039, "entry_point": 1982464000, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_1765", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1982464000, "timestamp": "00:01:56.574", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 5099520, "start_va": 1983447040, "type": "region", "version": 1 }, "end_va": 1988546559, "entry_point": 1983447040, "filename": "\\Windows\\SysWOW64\\windows.storage.dll", "id": "region_1766", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\syswow64\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 1983447040, "timestamp": "00:01:56.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1310720, "start_va": 1989541888, "type": "region", "version": 1 }, "end_va": 1990852607, "entry_point": 1989541888, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_1767", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1989541888, "timestamp": "00:01:56.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1990852608, "type": "region", "version": 1 }, "end_va": 1991028735, "entry_point": 1990852608, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_1768", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1990852608, "timestamp": "00:01:56.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 1991049216, "type": "region", "version": 1 }, "end_va": 1991110655, "entry_point": 1991049216, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_1769", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1991049216, "timestamp": "00:01:56.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1992294400, "type": "region", "version": 1 }, "end_va": 1992572927, "entry_point": 1992294400, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_1770", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1992294400, "timestamp": "00:01:56.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1992622080, "type": "region", "version": 1 }, "end_va": 1993125887, "entry_point": 1992622080, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_1771", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1992622080, "timestamp": "00:01:56.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1363968, "start_va": 1995702272, "type": "region", "version": 1 }, "end_va": 1997066239, "entry_point": 1995702272, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_1772", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1995702272, "timestamp": "00:01:56.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2146107392, "type": "region", "version": 1 }, "end_va": 2147155967, "entry_point": 0, "filename": null, "id": "region_1773", "name": "pagefile_0x000000007feb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2146107392, "timestamp": "00:01:56.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2147319808, "type": "region", "version": 1 }, "end_va": 2147332095, "entry_point": 0, "filename": null, "id": "region_1774", "name": "private_0x000000007ffd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147319808, "timestamp": "00:01:56.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1507328, "start_va": 31129600, "type": "region", "version": 1 }, "end_va": 32636927, "entry_point": 0, "filename": null, "id": "region_1775", "name": "private_0x0000000001db0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31129600, "timestamp": "00:01:56.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 3014656, "type": "region", "version": 1 }, "end_va": 3145727, "entry_point": 0, "filename": null, "id": "region_1776", "name": "private_0x00000000002e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3014656, "timestamp": "00:01:56.576", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 32636928, "type": "region", "version": 1 }, "end_va": 36007935, "entry_point": 32636928, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_1777", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 32636928, "timestamp": "00:01:56.577", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16814080, "start_va": 36044800, "type": "region", "version": 1 }, "end_va": 52858879, "entry_point": 0, "filename": null, "id": "region_1778", "name": "private_0x0000000002260000", "norm_filename": null, "region_type": "private_memory", "start_va": 36044800, "timestamp": "00:01:56.581", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 3014656, "type": "region", "version": 1 }, "end_va": 3080191, "entry_point": 0, "filename": null, "id": "region_1779", "name": "private_0x00000000002e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3014656, "timestamp": "00:01:56.601", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 3080192, "type": "region", "version": 1 }, "end_va": 3145727, "entry_point": 0, "filename": null, "id": "region_1780", "name": "private_0x00000000002f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3080192, "timestamp": "00:01:56.601", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 31129600, "type": "region", "version": 1 }, "end_va": 32178175, "entry_point": 0, "filename": null, "id": "region_1781", "name": "private_0x0000000001db0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31129600, "timestamp": "00:01:56.601", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 32571392, "type": "region", "version": 1 }, "end_va": 32636927, "entry_point": 0, "filename": null, "id": "region_1782", "name": "private_0x0000000001f10000", "norm_filename": null, "region_type": "private_memory", "start_va": 32571392, "timestamp": "00:01:56.601", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 81920, "start_va": 3211264, "type": "region", "version": 1 }, "end_va": 3293183, "entry_point": 0, "filename": null, "id": "region_1783", "name": "private_0x0000000000310000", "norm_filename": null, "region_type": "private_memory", "start_va": 3211264, "timestamp": "00:01:56.602", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 20480, "start_va": 3014656, "type": "region", "version": 1 }, "end_va": 3035135, "entry_point": 0, "filename": null, "id": "region_1784", "name": "pagefile_0x00000000002e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3014656, "timestamp": "00:01:56.603", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 3211264, "type": "region", "version": 1 }, "end_va": 3473407, "entry_point": 0, "filename": null, "id": "region_1821", "name": "private_0x0000000000310000", "norm_filename": null, "region_type": "private_memory", "start_va": 3211264, "timestamp": "00:01:56.650", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 52887552, "type": "region", "version": 1 }, "end_va": 53936127, "entry_point": 0, "filename": null, "id": "region_1822", "name": "private_0x0000000003270000", "norm_filename": null, "region_type": "private_memory", "start_va": 52887552, "timestamp": "00:01:56.650", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2147307520, "type": "region", "version": 1 }, "end_va": 2147319807, "entry_point": 0, "filename": null, "id": "region_1823", "name": "private_0x000000007ffd5000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147307520, "timestamp": "00:01:56.650", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 1940848640, "type": "region", "version": 1 }, "end_va": 1940926463, "entry_point": 1940848640, "filename": "\\Windows\\SysWOW64\\cryptsp.dll", "id": "region_1824", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\syswow64\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 1940848640, "timestamp": "00:01:56.654", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 110592, "start_va": 1940717568, "type": "region", "version": 1 }, "end_va": 1940828159, "entry_point": 1940717568, "filename": "\\Windows\\SysWOW64\\bcrypt.dll", "id": "region_1825", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\syswow64\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 1940717568, "timestamp": "00:01:56.655", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 192512, "start_va": 1940520960, "type": "region", "version": 1 }, "end_va": 1940713471, "entry_point": 1940520960, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_1826", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 1940520960, "timestamp": "00:01:56.657", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 3014656, "type": "region", "version": 1 }, "end_va": 3043327, "entry_point": 0, "filename": null, "id": "region_1827", "name": "private_0x00000000002e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3014656, "timestamp": "00:02:31.170", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 3211264, "type": "region", "version": 1 }, "end_va": 3215359, "entry_point": 0, "filename": null, "id": "region_1848", "name": "pagefile_0x0000000000310000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3211264, "timestamp": "00:03:03.923", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 3276800, "type": "region", "version": 1 }, "end_va": 3538943, "entry_point": 0, "filename": null, "id": "region_1860", "name": "private_0x0000000000320000", "norm_filename": null, "region_type": "private_memory", "start_va": 3276800, "timestamp": "00:03:03.968", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 3538944, "type": "region", "version": 1 }, "end_va": 3801087, "entry_point": 0, "filename": null, "id": "region_1861", "name": "private_0x0000000000360000", "norm_filename": null, "region_type": "private_memory", "start_va": 3538944, "timestamp": "00:03:03.968", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 53936128, "type": "region", "version": 1 }, "end_va": 54984703, "entry_point": 0, "filename": null, "id": "region_1863", "name": "private_0x0000000003370000", "norm_filename": null, "region_type": "private_memory", "start_va": 53936128, "timestamp": "00:03:03.968", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 958464, "start_va": 1957232640, "type": "region", "version": 1 }, "end_va": 1958191103, "entry_point": 1957232640, "filename": "\\Windows\\SysWOW64\\ole32.dll", "id": "region_1864", "name": "ole32.dll", "norm_filename": "c:\\windows\\syswow64\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1957232640, "timestamp": "00:03:03.968", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2146095104, "type": "region", "version": 1 }, "end_va": 2146107391, "entry_point": 0, "filename": null, "id": "region_1865", "name": "private_0x000000007fead000", "norm_filename": null, "region_type": "private_memory", "start_va": 2146095104, "timestamp": "00:03:03.968", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 479232, "start_va": 1945960448, "type": "region", "version": 1 }, "end_va": 1946439679, "entry_point": 1945960448, "filename": "\\Windows\\SysWOW64\\uxtheme.dll", "id": "region_1867", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\syswow64\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 1945960448, "timestamp": "00:03:03.972", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 56557568, "type": "region", "version": 1 }, "end_va": 56623103, "entry_point": 0, "filename": null, "id": "region_1903", "name": "private_0x00000000035f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 56557568, "timestamp": "00:03:04.023", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1318912, "start_va": 1944584192, "type": "region", "version": 1 }, "end_va": 1945903103, "entry_point": 1944584192, "filename": "\\Windows\\SysWOW64\\propsys.dll", "id": "region_1904", "name": "propsys.dll", "norm_filename": "c:\\windows\\syswow64\\propsys.dll", "region_type": "memory_mapped_file", "start_va": 1944584192, "timestamp": "00:03:04.023", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 1947533312, "type": "region", "version": 1 }, "end_va": 1948131327, "entry_point": 1947533312, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_1905", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 1947533312, "timestamp": "00:03:04.023", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 3801088, "type": "region", "version": 1 }, "end_va": 3805183, "entry_point": 0, "filename": null, "id": "region_1923", "name": "pagefile_0x00000000003a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3801088, "timestamp": "00:03:04.096", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 3866624, "type": "region", "version": 1 }, "end_va": 3870719, "entry_point": 0, "filename": null, "id": "region_1924", "name": "pagefile_0x00000000003b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 3866624, "timestamp": "00:03:04.096", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 3997696, "type": "region", "version": 1 }, "end_va": 4014079, "entry_point": 3997696, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db", "id": "region_1925", "name": "cversions.2.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db", "region_type": "memory_mapped_file", "start_va": 3997696, "timestamp": "00:03:04.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 4063232, "type": "region", "version": 1 }, "end_va": 4079615, "entry_point": 4063232, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db", "id": "region_1926", "name": "cversions.2.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db", "region_type": "memory_mapped_file", "start_va": 4063232, "timestamp": "00:03:04.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 274432, "start_va": 5308416, "type": "region", "version": 1 }, "end_va": 5582847, "entry_point": 5308416, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db", "id": "region_1927", "name": "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db", "region_type": "memory_mapped_file", "start_va": 5308416, "timestamp": "00:03:04.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 69632, "start_va": 5636096, "type": "region", "version": 1 }, "end_va": 5705727, "entry_point": 5636096, "filename": "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui", "id": "region_1928", "name": "propsys.dll.mui", "norm_filename": "c:\\windows\\syswow64\\en-us\\propsys.dll.mui", "region_type": "memory_mapped_file", "start_va": 5636096, "timestamp": "00:03:04.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 5767168, "type": "region", "version": 1 }, "end_va": 5771263, "entry_point": 0, "filename": null, "id": "region_1929", "name": "pagefile_0x0000000000580000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5767168, "timestamp": "00:03:04.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 102400, "start_va": 32178176, "type": "region", "version": 1 }, "end_va": 32280575, "entry_point": 32178176, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db", "id": "region_1930", "name": "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db", "region_type": "memory_mapped_file", "start_va": 32178176, "timestamp": "00:03:04.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 32309248, "type": "region", "version": 1 }, "end_va": 32571391, "entry_point": 0, "filename": null, "id": "region_1931", "name": "private_0x0000000001ed0000", "norm_filename": null, "region_type": "private_memory", "start_va": 32309248, "timestamp": "00:03:04.097", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 569344, "start_va": 54984704, "type": "region", "version": 1 }, "end_va": 55554047, "entry_point": 54984704, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db", "id": "region_1932", "name": "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db", "region_type": "memory_mapped_file", "start_va": 54984704, "timestamp": "00:03:04.098", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 55574528, "type": "region", "version": 1 }, "end_va": 55836671, "entry_point": 0, "filename": null, "id": "region_1933", "name": "private_0x0000000003500000", "norm_filename": null, "region_type": "private_memory", "start_va": 55574528, "timestamp": "00:03:04.098", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 56623104, "type": "region", "version": 1 }, "end_va": 57671679, "entry_point": 0, "filename": null, "id": "region_1934", "name": "private_0x0000000003600000", "norm_filename": null, "region_type": "private_memory", "start_va": 56623104, "timestamp": "00:03:04.098", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 57671680, "type": "region", "version": 1 }, "end_va": 58720255, "entry_point": 0, "filename": null, "id": "region_1935", "name": "private_0x0000000003700000", "norm_filename": null, "region_type": "private_memory", "start_va": 57671680, "timestamp": "00:03:04.098", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2887680, "start_va": 1937571840, "type": "region", "version": 1 }, "end_va": 1940459519, "entry_point": 1937571840, "filename": "\\Windows\\SysWOW64\\iertutil.dll", "id": "region_1936", "name": "iertutil.dll", "norm_filename": "c:\\windows\\syswow64\\iertutil.dll", "region_type": "memory_mapped_file", "start_va": 1937571840, "timestamp": "00:03:04.098", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1441792, "start_va": 1943142400, "type": "region", "version": 1 }, "end_va": 1944584191, "entry_point": 1943142400, "filename": "\\Windows\\SysWOW64\\urlmon.dll", "id": "region_1937", "name": "urlmon.dll", "norm_filename": "c:\\windows\\syswow64\\urlmon.dll", "region_type": "memory_mapped_file", "start_va": 1943142400, "timestamp": "00:03:04.100", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 532480, "start_va": 1950416896, "type": "region", "version": 1 }, "end_va": 1950949375, "entry_point": 1950416896, "filename": "\\Windows\\SysWOW64\\clbcatq.dll", "id": "region_1938", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\syswow64\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 1950416896, "timestamp": "00:03:04.105", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 1958543360, "type": "region", "version": 1 }, "end_va": 1958764543, "entry_point": 1958543360, "filename": "\\Windows\\SysWOW64\\cfgmgr32.dll", "id": "region_1939", "name": "cfgmgr32.dll", "norm_filename": "c:\\windows\\syswow64\\cfgmgr32.dll", "region_type": "memory_mapped_file", "start_va": 1958543360, "timestamp": "00:03:04.105", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2146070528, "type": "region", "version": 1 }, "end_va": 2146082815, "entry_point": 0, "filename": null, "id": "region_1940", "name": "private_0x000000007fea7000", "norm_filename": null, "region_type": "private_memory", "start_va": 2146070528, "timestamp": "00:03:04.105", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2146082816, "type": "region", "version": 1 }, "end_va": 2146095103, "entry_point": 0, "filename": null, "id": "region_1941", "name": "private_0x000000007feaa000", "norm_filename": null, "region_type": "private_memory", "start_va": 2146082816, "timestamp": "00:03:04.105", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 4128768, "type": "region", "version": 1 }, "end_va": 4132863, "entry_point": 0, "filename": null, "id": "region_1962", "name": "pagefile_0x00000000003f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4128768, "timestamp": "00:03:04.164", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 94208, "start_va": 1942945792, "type": "region", "version": 1 }, "end_va": 1943039999, "entry_point": 1942945792, "filename": "\\Windows\\SysWOW64\\mpr.dll", "id": "region_1963", "name": "mpr.dll", "norm_filename": "c:\\windows\\syswow64\\mpr.dll", "region_type": "memory_mapped_file", "start_va": 1942945792, "timestamp": "00:03:04.165", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1943076864, "type": "region", "version": 1 }, "end_va": 1943126015, "entry_point": 1943076864, "filename": "\\Windows\\SysWOW64\\pcacli.dll", "id": "region_1964", "name": "pcacli.dll", "norm_filename": "c:\\windows\\syswow64\\pcacli.dll", "region_type": "memory_mapped_file", "start_va": 1943076864, "timestamp": "00:03:04.165", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 55836672, "type": "region", "version": 1 }, "end_va": 55840767, "entry_point": 0, "filename": null, "id": "region_1965", "name": "pagefile_0x0000000003540000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 55836672, "timestamp": "00:03:04.192", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\tmpAD23.tmp.bat", "filename": "c:\\windows\\syswow64\\cmd.exe", "id": "proc_13", "image_name": "cmd.exe", "monitor_reason": "child_process", "monitored_id": 13, "origin_monitor_id": 12, "ref_parent_process": { "ref_id": "proc_12", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 6160384, "type": "region", "version": 1 }, "end_va": 6291455, "entry_point": 0, "filename": null, "id": "region_1828", "name": "private_0x00000000005e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6160384, "timestamp": "00:03:03.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 6291456, "type": "region", "version": 1 }, "end_va": 6299647, "entry_point": 0, "filename": null, "id": "region_1829", "name": "private_0x0000000000600000", "norm_filename": null, "region_type": "private_memory", "start_va": 6291456, "timestamp": "00:03:03.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 6356992, "type": "region", "version": 1 }, "end_va": 6438911, "entry_point": 0, "filename": null, "id": "region_1830", "name": "pagefile_0x0000000000610000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6356992, "timestamp": "00:03:03.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 6488064, "type": "region", "version": 1 }, "end_va": 6750207, "entry_point": 0, "filename": null, "id": "region_1831", "name": "private_0x0000000000630000", "norm_filename": null, "region_type": "private_memory", "start_va": 6488064, "timestamp": "00:03:03.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 6750208, "type": "region", "version": 1 }, "end_va": 7798783, "entry_point": 0, "filename": null, "id": "region_1832", "name": "private_0x0000000000670000", "norm_filename": null, "region_type": "private_memory", "start_va": 6750208, "timestamp": "00:03:03.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 7798784, "type": "region", "version": 1 }, "end_va": 7815167, "entry_point": 0, "filename": null, "id": "region_1833", "name": "pagefile_0x0000000000770000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7798784, "timestamp": "00:03:03.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 7864320, "type": "region", "version": 1 }, "end_va": 7868415, "entry_point": 0, "filename": null, "id": "region_1834", "name": "pagefile_0x0000000000780000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7864320, "timestamp": "00:03:03.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 7929856, "type": "region", "version": 1 }, "end_va": 7938047, "entry_point": 0, "filename": null, "id": "region_1835", "name": "private_0x0000000000790000", "norm_filename": null, "region_type": "private_memory", "start_va": 7929856, "timestamp": "00:03:03.794", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 327680, "start_va": 12189696, "type": "region", "version": 1 }, "end_va": 12517375, "entry_point": 12189696, "filename": "\\Windows\\SysWOW64\\cmd.exe", "id": "region_1836", "name": "cmd.exe", "norm_filename": "c:\\windows\\syswow64\\cmd.exe", "region_type": "memory_mapped_file", "start_va": 12189696, "timestamp": "00:03:03.795", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 12517376, "type": "region", "version": 1 }, "end_va": 79626239, "entry_point": 0, "filename": null, "id": "region_1837", "name": "pagefile_0x0000000000bf0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 12517376, "timestamp": "00:03:03.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1997078528, "type": "region", "version": 1 }, "end_va": 1998622719, "entry_point": 1997078528, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_1838", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1997078528, "timestamp": "00:03:03.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2144337920, "type": "region", "version": 1 }, "end_va": 2144481279, "entry_point": 0, "filename": null, "id": "region_1839", "name": "pagefile_0x000000007fd00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2144337920, "timestamp": "00:03:03.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2144514048, "type": "region", "version": 1 }, "end_va": 2144518143, "entry_point": 0, "filename": null, "id": "region_1840", "name": "private_0x000000007fd2b000", "norm_filename": null, "region_type": "private_memory", "start_va": 2144514048, "timestamp": "00:03:03.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2144518144, "type": "region", "version": 1 }, "end_va": 2144522239, "entry_point": 0, "filename": null, "id": "region_1841", "name": "private_0x000000007fd2c000", "norm_filename": null, "region_type": "private_memory", "start_va": 2144518144, "timestamp": "00:03:03.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2144522240, "type": "region", "version": 1 }, "end_va": 2144534527, "entry_point": 0, "filename": null, "id": "region_1842", "name": "private_0x000000007fd2d000", "norm_filename": null, "region_type": "private_memory", "start_va": 2144522240, "timestamp": "00:03:03.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_1843", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:03:03.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138533214945280, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138535362363391, "entry_point": 0, "filename": null, "id": "region_1844", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:03:03.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138535362363392, "type": "region", "version": 1 }, "end_va": 140734385618943, "entry_point": 0, "filename": null, "id": "region_1845", "name": "pagefile_0x00007dff47100000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138535362363392, "timestamp": "00:03:03.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140734385618944, "type": "region", "version": 1 }, "end_va": 140734387462143, "entry_point": 140734385618944, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_1846", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140734385618944, "timestamp": "00:03:03.921", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3100827648, "start_va": 140734387462144, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_1847", "name": "private_0x00007fff472c2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140734387462144, "timestamp": "00:03:03.921", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 8585216, "type": "region", "version": 1 }, "end_va": 8650751, "entry_point": 0, "filename": null, "id": "region_1849", "name": "private_0x0000000000830000", "norm_filename": null, "region_type": "private_memory", "start_va": 8585216, "timestamp": "00:03:03.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1988624384, "type": "region", "version": 1 }, "end_va": 1988947967, "entry_point": 1988624384, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_1850", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1988624384, "timestamp": "00:03:03.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1988952064, "type": "region", "version": 1 }, "end_va": 1989423103, "entry_point": 1988952064, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_1851", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1988952064, "timestamp": "00:03:03.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 10289152, "type": "region", "version": 1 }, "end_va": 11337727, "entry_point": 0, "filename": null, "id": "region_1852", "name": "private_0x00000000009d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 10289152, "timestamp": "00:03:03.946", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1988558848, "type": "region", "version": 1 }, "end_va": 1988591615, "entry_point": 1988558848, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_1853", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1988558848, "timestamp": "00:03:03.946", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 6160384, "type": "region", "version": 1 }, "end_va": 6225919, "entry_point": 0, "filename": null, "id": "region_1854", "name": "pagefile_0x00000000005e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6160384, "timestamp": "00:03:03.953", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 8650752, "type": "region", "version": 1 }, "end_va": 9428991, "entry_point": 8650752, "filename": "\\Windows\\System32\\locale.nls", "id": "region_1855", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 8650752, "timestamp": "00:03:03.953", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1953431552, "type": "region", "version": 1 }, "end_va": 1954963455, "entry_point": 1953431552, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_1856", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1953431552, "timestamp": "00:03:03.953", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1982464000, "type": "region", "version": 1 }, "end_va": 1983447039, "entry_point": 1982464000, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_1857", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1982464000, "timestamp": "00:03:03.954", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2143289344, "type": "region", "version": 1 }, "end_va": 2144337919, "entry_point": 0, "filename": null, "id": "region_1858", "name": "pagefile_0x000000007fc00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2143289344, "timestamp": "00:03:03.954", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 7995392, "type": "region", "version": 1 }, "end_va": 8257535, "entry_point": 0, "filename": null, "id": "region_1966", "name": "private_0x00000000007a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 7995392, "timestamp": "00:03:04.215", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 79626240, "type": "region", "version": 1 }, "end_va": 80674815, "entry_point": 0, "filename": null, "id": "region_1967", "name": "private_0x0000000004bf0000", "norm_filename": null, "region_type": "private_memory", "start_va": 79626240, "timestamp": "00:03:04.215", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 82247680, "type": "region", "version": 1 }, "end_va": 82313215, "entry_point": 0, "filename": null, "id": "region_1968", "name": "private_0x0000000004e70000", "norm_filename": null, "region_type": "private_memory", "start_va": 82247680, "timestamp": "00:03:04.215", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1951006720, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951006720, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_1969", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1951006720, "timestamp": "00:03:04.215", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2144501760, "type": "region", "version": 1 }, "end_va": 2144514047, "entry_point": 0, "filename": null, "id": "region_1970", "name": "private_0x000000007fd28000", "norm_filename": null, "region_type": "private_memory", "start_va": 2144501760, "timestamp": "00:03:04.215", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 6225920, "type": "region", "version": 1 }, "end_va": 6242303, "entry_point": 0, "filename": null, "id": "region_1971", "name": "private_0x00000000005f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6225920, "timestamp": "00:03:04.217", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 6291456, "type": "region", "version": 1 }, "end_va": 6307839, "entry_point": 0, "filename": null, "id": "region_1972", "name": "private_0x0000000000600000", "norm_filename": null, "region_type": "private_memory", "start_va": 6291456, "timestamp": "00:03:04.247", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1946419200, "type": "region", "version": 1 }, "end_va": 1946451967, "entry_point": 1946419200, "filename": "\\Windows\\SysWOW64\\cmdext.dll", "id": "region_1973", "name": "cmdext.dll", "norm_filename": "c:\\windows\\syswow64\\cmdext.dll", "region_type": "memory_mapped_file", "start_va": 1946419200, "timestamp": "00:03:04.267", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1992622080, "type": "region", "version": 1 }, "end_va": 1993125887, "entry_point": 1992622080, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_1974", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1992622080, "timestamp": "00:03:04.273", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1951793152, "type": "region", "version": 1 }, "end_va": 1952067583, "entry_point": 1951793152, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_1975", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1951793152, "timestamp": "00:03:04.273", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1956511744, "type": "region", "version": 1 }, "end_va": 1957216255, "entry_point": 1956511744, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_1976", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1956511744, "timestamp": "00:03:04.274", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1946943488, "type": "region", "version": 1 }, "end_va": 1947066367, "entry_point": 1946943488, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_1977", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1946943488, "timestamp": "00:03:04.275", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1946877952, "type": "region", "version": 1 }, "end_va": 1946918911, "entry_point": 1946877952, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_1978", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1946877952, "timestamp": "00:03:04.276", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1946484736, "type": "region", "version": 1 }, "end_va": 1946849279, "entry_point": 1946484736, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_1979", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1946484736, "timestamp": "00:03:04.276", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 8257536, "type": "region", "version": 1 }, "end_va": 8323071, "entry_point": 0, "filename": null, "id": "region_1980", "name": "private_0x00000000007e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 8257536, "timestamp": "00:03:04.289", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 82313216, "type": "region", "version": 1 }, "end_va": 85684223, "entry_point": 82313216, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_1981", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 82313216, "timestamp": "00:03:04.306", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 135168, "start_va": 8323072, "type": "region", "version": 1 }, "end_va": 8458239, "entry_point": 8323072, "filename": "\\Windows\\SysWOW64\\en-US\\cmd.exe.mui", "id": "region_2272", "name": "cmd.exe.mui", "norm_filename": "c:\\windows\\syswow64\\en-us\\cmd.exe.mui", "region_type": "memory_mapped_file", "start_va": 8323072, "timestamp": "00:03:05.156", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Windows\\system32\\cmd.exe\" /c del C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vwOrbzLbc.exe > nul", "filename": "c:\\windows\\syswow64\\cmd.exe", "id": "proc_15", "image_name": "cmd.exe", "monitor_reason": "child_process", "monitored_id": 15, "origin_monitor_id": 12, "ref_parent_process": { "ref_id": "proc_12", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 327680, "start_va": 12189696, "type": "region", "version": 1 }, "end_va": 12517375, "entry_point": 12189696, "filename": "\\Windows\\SysWOW64\\cmd.exe", "id": "region_1942", "name": "cmd.exe", "norm_filename": "c:\\windows\\syswow64\\cmd.exe", "region_type": "memory_mapped_file", "start_va": 12189696, "timestamp": "00:03:04.133", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 14090240, "type": "region", "version": 1 }, "end_va": 81199103, "entry_point": 0, "filename": null, "id": "region_1943", "name": "pagefile_0x0000000000d70000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 14090240, "timestamp": "00:03:04.134", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 81199104, "type": "region", "version": 1 }, "end_va": 81330175, "entry_point": 0, "filename": null, "id": "region_1944", "name": "private_0x0000000004d70000", "norm_filename": null, "region_type": "private_memory", "start_va": 81199104, "timestamp": "00:03:04.134", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 81330176, "type": "region", "version": 1 }, "end_va": 81338367, "entry_point": 0, "filename": null, "id": "region_1945", "name": "private_0x0000000004d90000", "norm_filename": null, "region_type": "private_memory", "start_va": 81330176, "timestamp": "00:03:04.134", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 81395712, "type": "region", "version": 1 }, "end_va": 81477631, "entry_point": 0, "filename": null, "id": "region_1946", "name": "pagefile_0x0000000004da0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 81395712, "timestamp": "00:03:04.134", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 81526784, "type": "region", "version": 1 }, "end_va": 81788927, "entry_point": 0, "filename": null, "id": "region_1947", "name": "private_0x0000000004dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 81526784, "timestamp": "00:03:04.134", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 81788928, "type": "region", "version": 1 }, "end_va": 82837503, "entry_point": 0, "filename": null, "id": "region_1948", "name": "private_0x0000000004e00000", "norm_filename": null, "region_type": "private_memory", "start_va": 81788928, "timestamp": "00:03:04.134", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 82837504, "type": "region", "version": 1 }, "end_va": 82853887, "entry_point": 0, "filename": null, "id": "region_1949", "name": "pagefile_0x0000000004f00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 82837504, "timestamp": "00:03:04.134", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 82903040, "type": "region", "version": 1 }, "end_va": 82907135, "entry_point": 0, "filename": null, "id": "region_1950", "name": "pagefile_0x0000000004f10000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 82903040, "timestamp": "00:03:04.134", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 82968576, "type": "region", "version": 1 }, "end_va": 82976767, "entry_point": 0, "filename": null, "id": "region_1951", "name": "private_0x0000000004f20000", "norm_filename": null, "region_type": "private_memory", "start_va": 82968576, "timestamp": "00:03:04.134", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1997078528, "type": "region", "version": 1 }, "end_va": 1998622719, "entry_point": 1997078528, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_1952", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1997078528, "timestamp": "00:03:04.134", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2122579968, "type": "region", "version": 1 }, "end_va": 2122723327, "entry_point": 0, "filename": null, "id": "region_1953", "name": "pagefile_0x000000007e840000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2122579968, "timestamp": "00:03:04.135", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2122731520, "type": "region", "version": 1 }, "end_va": 2122735615, "entry_point": 0, "filename": null, "id": "region_1954", "name": "private_0x000000007e865000", "norm_filename": null, "region_type": "private_memory", "start_va": 2122731520, "timestamp": "00:03:04.135", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2122752000, "type": "region", "version": 1 }, "end_va": 2122756095, "entry_point": 0, "filename": null, "id": "region_1955", "name": "private_0x000000007e86a000", "norm_filename": null, "region_type": "private_memory", "start_va": 2122752000, "timestamp": "00:03:04.135", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2122764288, "type": "region", "version": 1 }, "end_va": 2122776575, "entry_point": 0, "filename": null, "id": "region_1956", "name": "private_0x000000007e86d000", "norm_filename": null, "region_type": "private_memory", "start_va": 2122764288, "timestamp": "00:03:04.135", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_1957", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:03:04.135", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138533214945280, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138535362363391, "entry_point": 0, "filename": null, "id": "region_1958", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:03:04.135", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138535362363392, "type": "region", "version": 1 }, "end_va": 140734385618943, "entry_point": 0, "filename": null, "id": "region_1959", "name": "pagefile_0x00007dff47100000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138535362363392, "timestamp": "00:03:04.135", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140734385618944, "type": "region", "version": 1 }, "end_va": 140734387462143, "entry_point": 140734385618944, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_1960", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140734385618944, "timestamp": "00:03:04.135", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3100827648, "start_va": 140734387462144, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_1961", "name": "private_0x00007fff472c2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140734387462144, "timestamp": "00:03:04.135", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 83820544, "type": "region", "version": 1 }, "end_va": 83886079, "entry_point": 0, "filename": null, "id": "region_2050", "name": "private_0x0000000004ff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 83820544, "timestamp": "00:03:04.561", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1988624384, "type": "region", "version": 1 }, "end_va": 1988947967, "entry_point": 1988624384, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_2051", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1988624384, "timestamp": "00:03:04.561", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1988952064, "type": "region", "version": 1 }, "end_va": 1989423103, "entry_point": 1988952064, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_2052", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1988952064, "timestamp": "00:03:04.561", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 84017152, "type": "region", "version": 1 }, "end_va": 85065727, "entry_point": 0, "filename": null, "id": "region_2053", "name": "private_0x0000000005020000", "norm_filename": null, "region_type": "private_memory", "start_va": 84017152, "timestamp": "00:03:04.570", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1988558848, "type": "region", "version": 1 }, "end_va": 1988591615, "entry_point": 1988558848, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_2054", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1988558848, "timestamp": "00:03:04.570", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 81199104, "type": "region", "version": 1 }, "end_va": 81264639, "entry_point": 0, "filename": null, "id": "region_2302", "name": "pagefile_0x0000000004d70000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 81199104, "timestamp": "00:03:05.255", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 83034112, "type": "region", "version": 1 }, "end_va": 83812351, "entry_point": 83034112, "filename": "\\Windows\\System32\\locale.nls", "id": "region_2303", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 83034112, "timestamp": "00:03:05.255", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 85065728, "type": "region", "version": 1 }, "end_va": 85327871, "entry_point": 0, "filename": null, "id": "region_2304", "name": "private_0x0000000005120000", "norm_filename": null, "region_type": "private_memory", "start_va": 85065728, "timestamp": "00:03:05.255", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 85327872, "type": "region", "version": 1 }, "end_va": 86376447, "entry_point": 0, "filename": null, "id": "region_2305", "name": "private_0x0000000005160000", "norm_filename": null, "region_type": "private_memory", "start_va": 85327872, "timestamp": "00:03:05.255", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 86638592, "type": "region", "version": 1 }, "end_va": 86704127, "entry_point": 0, "filename": null, "id": "region_2306", "name": "private_0x00000000052a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 86638592, "timestamp": "00:03:05.255", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1951006720, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951006720, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_2307", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1951006720, "timestamp": "00:03:05.255", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1953431552, "type": "region", "version": 1 }, "end_va": 1954963455, "entry_point": 1953431552, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_2308", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1953431552, "timestamp": "00:03:05.255", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1982464000, "type": "region", "version": 1 }, "end_va": 1983447039, "entry_point": 1982464000, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_2309", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1982464000, "timestamp": "00:03:05.255", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2121531392, "type": "region", "version": 1 }, "end_va": 2122579967, "entry_point": 0, "filename": null, "id": "region_2310", "name": "pagefile_0x000000007e740000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2121531392, "timestamp": "00:03:05.255", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2122739712, "type": "region", "version": 1 }, "end_va": 2122751999, "entry_point": 0, "filename": null, "id": "region_2311", "name": "private_0x000000007e867000", "norm_filename": null, "region_type": "private_memory", "start_va": 2122739712, "timestamp": "00:03:05.255", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 81264640, "type": "region", "version": 1 }, "end_va": 81281023, "entry_point": 0, "filename": null, "id": "region_2312", "name": "private_0x0000000004d80000", "norm_filename": null, "region_type": "private_memory", "start_va": 81264640, "timestamp": "00:03:05.257", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 81330176, "type": "region", "version": 1 }, "end_va": 81346559, "entry_point": 0, "filename": null, "id": "region_2313", "name": "private_0x0000000004d90000", "norm_filename": null, "region_type": "private_memory", "start_va": 81330176, "timestamp": "00:03:05.265", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "vssadmin.exe Delete Shadows /All /Quiet", "filename": "c:\\windows\\syswow64\\vssadmin.exe", "id": "proc_16", "image_name": "vssadmin.exe", "monitor_reason": "child_process", "monitored_id": 16, "origin_monitor_id": 13, "ref_parent_process": { "ref_id": "proc_13", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 12713984, "type": "region", "version": 1 }, "end_va": 12836863, "entry_point": 12713984, "filename": "\\Windows\\SysWOW64\\vssadmin.exe", "id": "region_1982", "name": "vssadmin.exe", "norm_filename": "c:\\windows\\syswow64\\vssadmin.exe", "region_type": "memory_mapped_file", "start_va": 12713984, "timestamp": "00:03:04.314", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 15728640, "type": "region", "version": 1 }, "end_va": 82837503, "entry_point": 0, "filename": null, "id": "region_1983", "name": "pagefile_0x0000000000f00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 15728640, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 82837504, "type": "region", "version": 1 }, "end_va": 82968575, "entry_point": 0, "filename": null, "id": "region_1984", "name": "private_0x0000000004f00000", "norm_filename": null, "region_type": "private_memory", "start_va": 82837504, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 82968576, "type": "region", "version": 1 }, "end_va": 82976767, "entry_point": 0, "filename": null, "id": "region_1985", "name": "private_0x0000000004f20000", "norm_filename": null, "region_type": "private_memory", "start_va": 82968576, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 83034112, "type": "region", "version": 1 }, "end_va": 83116031, "entry_point": 0, "filename": null, "id": "region_1986", "name": "pagefile_0x0000000004f30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 83034112, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 83165184, "type": "region", "version": 1 }, "end_va": 83427327, "entry_point": 0, "filename": null, "id": "region_1987", "name": "private_0x0000000004f50000", "norm_filename": null, "region_type": "private_memory", "start_va": 83165184, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 83427328, "type": "region", "version": 1 }, "end_va": 83689471, "entry_point": 0, "filename": null, "id": "region_1988", "name": "private_0x0000000004f90000", "norm_filename": null, "region_type": "private_memory", "start_va": 83427328, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 83689472, "type": "region", "version": 1 }, "end_va": 83705855, "entry_point": 0, "filename": null, "id": "region_1989", "name": "pagefile_0x0000000004fd0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 83689472, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 83755008, "type": "region", "version": 1 }, "end_va": 83759103, "entry_point": 0, "filename": null, "id": "region_1990", "name": "pagefile_0x0000000004fe0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 83755008, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 83820544, "type": "region", "version": 1 }, "end_va": 83828735, "entry_point": 0, "filename": null, "id": "region_1991", "name": "private_0x0000000004ff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 83820544, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1997078528, "type": "region", "version": 1 }, "end_va": 1998622719, "entry_point": 1997078528, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_1992", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1997078528, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2115043328, "type": "region", "version": 1 }, "end_va": 2115186687, "entry_point": 0, "filename": null, "id": "region_1993", "name": "pagefile_0x000000007e110000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2115043328, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2115219456, "type": "region", "version": 1 }, "end_va": 2115231743, "entry_point": 0, "filename": null, "id": "region_1994", "name": "private_0x000000007e13b000", "norm_filename": null, "region_type": "private_memory", "start_va": 2115219456, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2115231744, "type": "region", "version": 1 }, "end_va": 2115235839, "entry_point": 0, "filename": null, "id": "region_1995", "name": "private_0x000000007e13e000", "norm_filename": null, "region_type": "private_memory", "start_va": 2115231744, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2115235840, "type": "region", "version": 1 }, "end_va": 2115239935, "entry_point": 0, "filename": null, "id": "region_1996", "name": "private_0x000000007e13f000", "norm_filename": null, "region_type": "private_memory", "start_va": 2115235840, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_1997", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138533214945280, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138535362363391, "entry_point": 0, "filename": null, "id": "region_1998", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138535362363392, "type": "region", "version": 1 }, "end_va": 140734385618943, "entry_point": 0, "filename": null, "id": "region_1999", "name": "pagefile_0x00007dff47100000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138535362363392, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140734385618944, "type": "region", "version": 1 }, "end_va": 140734387462143, "entry_point": 140734385618944, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_2000", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140734385618944, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3100827648, "start_va": 140734387462144, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_2001", "name": "private_0x00007fff472c2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140734387462144, "timestamp": "00:03:04.385", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 84017152, "type": "region", "version": 1 }, "end_va": 84082687, "entry_point": 0, "filename": null, "id": "region_2002", "name": "private_0x0000000005020000", "norm_filename": null, "region_type": "private_memory", "start_va": 84017152, "timestamp": "00:03:04.394", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1988624384, "type": "region", "version": 1 }, "end_va": 1988947967, "entry_point": 1988624384, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_2003", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1988624384, "timestamp": "00:03:04.394", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1988952064, "type": "region", "version": 1 }, "end_va": 1989423103, "entry_point": 1988952064, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_2004", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1988952064, "timestamp": "00:03:04.394", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 84541440, "type": "region", "version": 1 }, "end_va": 85590015, "entry_point": 0, "filename": null, "id": "region_2005", "name": "private_0x00000000050a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 84541440, "timestamp": "00:03:04.402", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1988558848, "type": "region", "version": 1 }, "end_va": 1988591615, "entry_point": 1988558848, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_2006", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1988558848, "timestamp": "00:03:04.402", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 82837504, "type": "region", "version": 1 }, "end_va": 82903039, "entry_point": 0, "filename": null, "id": "region_2007", "name": "pagefile_0x0000000004f00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 82837504, "timestamp": "00:03:04.463", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 82903040, "type": "region", "version": 1 }, "end_va": 82919423, "entry_point": 0, "filename": null, "id": "region_2008", "name": "private_0x0000000004f10000", "norm_filename": null, "region_type": "private_memory", "start_va": 82903040, "timestamp": "00:03:04.463", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 53248, "start_va": 82968576, "type": "region", "version": 1 }, "end_va": 83021823, "entry_point": 82968576, "filename": "\\Windows\\SysWOW64\\en-US\\vssadmin.exe.mui", "id": "region_2009", "name": "vssadmin.exe.mui", "norm_filename": "c:\\windows\\syswow64\\en-us\\vssadmin.exe.mui", "region_type": "memory_mapped_file", "start_va": 82968576, "timestamp": "00:03:04.464", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 83886080, "type": "region", "version": 1 }, "end_va": 83890175, "entry_point": 0, "filename": null, "id": "region_2010", "name": "private_0x0000000005000000", "norm_filename": null, "region_type": "private_memory", "start_va": 83886080, "timestamp": "00:03:04.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 83951616, "type": "region", "version": 1 }, "end_va": 83955711, "entry_point": 0, "filename": null, "id": "region_2011", "name": "private_0x0000000005010000", "norm_filename": null, "region_type": "private_memory", "start_va": 83951616, "timestamp": "00:03:04.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 84082688, "type": "region", "version": 1 }, "end_va": 84344831, "entry_point": 0, "filename": null, "id": "region_2012", "name": "private_0x0000000005030000", "norm_filename": null, "region_type": "private_memory", "start_va": 84082688, "timestamp": "00:03:04.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 85590016, "type": "region", "version": 1 }, "end_va": 86368255, "entry_point": 85590016, "filename": "\\Windows\\System32\\locale.nls", "id": "region_2013", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 85590016, "timestamp": "00:03:04.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 86376448, "type": "region", "version": 1 }, "end_va": 86638591, "entry_point": 0, "filename": null, "id": "region_2014", "name": "private_0x0000000005260000", "norm_filename": null, "region_type": "private_memory", "start_va": 86376448, "timestamp": "00:03:04.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 87949312, "type": "region", "version": 1 }, "end_va": 88014847, "entry_point": 0, "filename": null, "id": "region_2015", "name": "private_0x00000000053e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 87949312, "timestamp": "00:03:04.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 88014848, "type": "region", "version": 1 }, "end_va": 89620479, "entry_point": 0, "filename": null, "id": "region_2016", "name": "pagefile_0x00000000053f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 88014848, "timestamp": "00:03:04.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 89653248, "type": "region", "version": 1 }, "end_va": 91230207, "entry_point": 0, "filename": null, "id": "region_2017", "name": "pagefile_0x0000000005580000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 89653248, "timestamp": "00:03:04.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 91291648, "type": "region", "version": 1 }, "end_va": 112263167, "entry_point": 0, "filename": null, "id": "region_2018", "name": "pagefile_0x0000000005710000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 91291648, "timestamp": "00:03:04.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1159168, "start_va": 1944977408, "type": "region", "version": 1 }, "end_va": 1946136575, "entry_point": 1944977408, "filename": "\\Windows\\SysWOW64\\vssapi.dll", "id": "region_2019", "name": "vssapi.dll", "norm_filename": "c:\\windows\\syswow64\\vssapi.dll", "region_type": "memory_mapped_file", "start_va": 1944977408, "timestamp": "00:03:04.465", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 69632, "start_va": 1946157056, "type": "region", "version": 1 }, "end_va": 1946226687, "entry_point": 1946157056, "filename": "\\Windows\\SysWOW64\\vsstrace.dll", "id": "region_2020", "name": "vsstrace.dll", "norm_filename": "c:\\windows\\syswow64\\vsstrace.dll", "region_type": "memory_mapped_file", "start_va": 1946157056, "timestamp": "00:03:04.467", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 98304, "start_va": 1946288128, "type": "region", "version": 1 }, "end_va": 1946386431, "entry_point": 1946288128, "filename": "\\Windows\\SysWOW64\\atl.dll", "id": "region_2021", "name": "atl.dll", "norm_filename": "c:\\windows\\syswow64\\atl.dll", "region_type": "memory_mapped_file", "start_va": 1946288128, "timestamp": "00:03:04.469", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1946484736, "type": "region", "version": 1 }, "end_va": 1946849279, "entry_point": 1946484736, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_2022", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1946484736, "timestamp": "00:03:04.470", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1946877952, "type": "region", "version": 1 }, "end_va": 1946918911, "entry_point": 1946877952, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_2023", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1946877952, "timestamp": "00:03:04.470", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1946943488, "type": "region", "version": 1 }, "end_va": 1947066367, "entry_point": 1946943488, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_2024", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1946943488, "timestamp": "00:03:04.470", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 1947533312, "type": "region", "version": 1 }, "end_va": 1948131327, "entry_point": 1947533312, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_2025", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 1947533312, "timestamp": "00:03:04.470", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1951006720, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951006720, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_2026", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1951006720, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1951793152, "type": "region", "version": 1 }, "end_va": 1952067583, "entry_point": 1951793152, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_2027", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1951793152, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1179648, "start_va": 1952120832, "type": "region", "version": 1 }, "end_va": 1953300479, "entry_point": 1952120832, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_2028", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1952120832, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1953431552, "type": "region", "version": 1 }, "end_va": 1954963455, "entry_point": 1953431552, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_2029", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1953431552, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1956511744, "type": "region", "version": 1 }, "end_va": 1957216255, "entry_point": 1956511744, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_2030", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1956511744, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 1979514880, "type": "region", "version": 1 }, "end_va": 1979543551, "entry_point": 1979514880, "filename": "\\Windows\\SysWOW64\\nsi.dll", "id": "region_2031", "name": "nsi.dll", "norm_filename": "c:\\windows\\syswow64\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 1979514880, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1810432, "start_va": 1979973632, "type": "region", "version": 1 }, "end_va": 1981784063, "entry_point": 1979973632, "filename": "\\Windows\\SysWOW64\\combase.dll", "id": "region_2032", "name": "combase.dll", "norm_filename": "c:\\windows\\syswow64\\combase.dll", "region_type": "memory_mapped_file", "start_va": 1979973632, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1982464000, "type": "region", "version": 1 }, "end_va": 1983447039, "entry_point": 1982464000, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_2033", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1982464000, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1310720, "start_va": 1989541888, "type": "region", "version": 1 }, "end_va": 1990852607, "entry_point": 1989541888, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_2034", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1989541888, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1990852608, "type": "region", "version": 1 }, "end_va": 1991028735, "entry_point": 1990852608, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_2035", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1990852608, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1992294400, "type": "region", "version": 1 }, "end_va": 1992572927, "entry_point": 1992294400, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_2036", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1992294400, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1992622080, "type": "region", "version": 1 }, "end_va": 1993125887, "entry_point": 1992622080, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_2037", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1992622080, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 376832, "start_va": 1994915840, "type": "region", "version": 1 }, "end_va": 1995292671, "entry_point": 1994915840, "filename": "\\Windows\\SysWOW64\\ws2_32.dll", "id": "region_2038", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\syswow64\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 1994915840, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1363968, "start_va": 1995702272, "type": "region", "version": 1 }, "end_va": 1997066239, "entry_point": 1995702272, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_2039", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1995702272, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2113994752, "type": "region", "version": 1 }, "end_va": 2115043327, "entry_point": 0, "filename": null, "id": "region_2040", "name": "pagefile_0x000000007e010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2113994752, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2115207168, "type": "region", "version": 1 }, "end_va": 2115219455, "entry_point": 0, "filename": null, "id": "region_2041", "name": "private_0x000000007e138000", "norm_filename": null, "region_type": "private_memory", "start_va": 2115207168, "timestamp": "00:03:04.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 84344832, "type": "region", "version": 1 }, "end_va": 84361215, "entry_point": 0, "filename": null, "id": "region_2042", "name": "private_0x0000000005070000", "norm_filename": null, "region_type": "private_memory", "start_va": 84344832, "timestamp": "00:03:04.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 84410368, "type": "region", "version": 1 }, "end_va": 84414463, "entry_point": 0, "filename": null, "id": "region_2043", "name": "pagefile_0x0000000005080000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 84410368, "timestamp": "00:03:04.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 84475904, "type": "region", "version": 1 }, "end_va": 84479999, "entry_point": 0, "filename": null, "id": "region_2044", "name": "pagefile_0x0000000005090000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 84475904, "timestamp": "00:03:04.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 110592, "start_va": 1944715264, "type": "region", "version": 1 }, "end_va": 1944825855, "entry_point": 1944715264, "filename": "\\Windows\\SysWOW64\\bcrypt.dll", "id": "region_2045", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\syswow64\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 1944715264, "timestamp": "00:03:04.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 1944846336, "type": "region", "version": 1 }, "end_va": 1944924159, "entry_point": 1944846336, "filename": "\\Windows\\SysWOW64\\cryptsp.dll", "id": "region_2046", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\syswow64\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 1944846336, "timestamp": "00:03:04.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 532480, "start_va": 1950416896, "type": "region", "version": 1 }, "end_va": 1950949375, "entry_point": 1950416896, "filename": "\\Windows\\SysWOW64\\clbcatq.dll", "id": "region_2047", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\syswow64\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 1950416896, "timestamp": "00:03:04.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1953366016, "type": "region", "version": 1 }, "end_va": 1953415167, "entry_point": 1953366016, "filename": "\\Windows\\SysWOW64\\kernel.appcore.dll", "id": "region_2048", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\syswow64\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 1953366016, "timestamp": "00:03:04.495", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 192512, "start_va": 1944518656, "type": "region", "version": 1 }, "end_va": 1944711167, "entry_point": 1944518656, "filename": "\\Windows\\SysWOW64\\rsaenh.dll", "id": "region_2049", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\syswow64\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 1944518656, "timestamp": "00:03:04.498", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f", "filename": "c:\\windows\\syswow64\\reg.exe", "id": "proc_17", "image_name": "reg.exe", "monitor_reason": "child_process", "monitored_id": 17, "origin_monitor_id": 13, "ref_parent_process": { "ref_id": "proc_13", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 6160384, "type": "region", "version": 1 }, "end_va": 6291455, "entry_point": 0, "filename": null, "id": "region_2055", "name": "private_0x00000000005e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6160384, "timestamp": "00:03:04.584", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 6291456, "type": "region", "version": 1 }, "end_va": 6299647, "entry_point": 0, "filename": null, "id": "region_2056", "name": "private_0x0000000000600000", "norm_filename": null, "region_type": "private_memory", "start_va": 6291456, "timestamp": "00:03:04.584", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 6356992, "type": "region", "version": 1 }, "end_va": 6438911, "entry_point": 0, "filename": null, "id": "region_2057", "name": "pagefile_0x0000000000610000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6356992, "timestamp": "00:03:04.584", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 6488064, "type": "region", "version": 1 }, "end_va": 6750207, "entry_point": 0, "filename": null, "id": "region_2058", "name": "private_0x0000000000630000", "norm_filename": null, "region_type": "private_memory", "start_va": 6488064, "timestamp": "00:03:04.584", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 6750208, "type": "region", "version": 1 }, "end_va": 7012351, "entry_point": 0, "filename": null, "id": "region_2059", "name": "private_0x0000000000670000", "norm_filename": null, "region_type": "private_memory", "start_va": 6750208, "timestamp": "00:03:04.584", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 7012352, "type": "region", "version": 1 }, "end_va": 7028735, "entry_point": 0, "filename": null, "id": "region_2060", "name": "pagefile_0x00000000006b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7012352, "timestamp": "00:03:04.584", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 7077888, "type": "region", "version": 1 }, "end_va": 7081983, "entry_point": 0, "filename": null, "id": "region_2061", "name": "pagefile_0x00000000006c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7077888, "timestamp": "00:03:04.584", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 7143424, "type": "region", "version": 1 }, "end_va": 7151615, "entry_point": 0, "filename": null, "id": "region_2062", "name": "private_0x00000000006d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 7143424, "timestamp": "00:03:04.584", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 339968, "start_va": 14876672, "type": "region", "version": 1 }, "end_va": 15216639, "entry_point": 14876672, "filename": "\\Windows\\SysWOW64\\reg.exe", "id": "region_2063", "name": "reg.exe", "norm_filename": "c:\\windows\\syswow64\\reg.exe", "region_type": "memory_mapped_file", "start_va": 14876672, "timestamp": "00:03:04.585", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 15269888, "type": "region", "version": 1 }, "end_va": 82378751, "entry_point": 0, "filename": null, "id": "region_2064", "name": "pagefile_0x0000000000e90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 15269888, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1997078528, "type": "region", "version": 1 }, "end_va": 1998622719, "entry_point": 1997078528, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_2065", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1997078528, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2116616192, "type": "region", "version": 1 }, "end_va": 2116759551, "entry_point": 0, "filename": null, "id": "region_2066", "name": "pagefile_0x000000007e290000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2116616192, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2116763648, "type": "region", "version": 1 }, "end_va": 2116767743, "entry_point": 0, "filename": null, "id": "region_2067", "name": "private_0x000000007e2b4000", "norm_filename": null, "region_type": "private_memory", "start_va": 2116763648, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2116775936, "type": "region", "version": 1 }, "end_va": 2116780031, "entry_point": 0, "filename": null, "id": "region_2068", "name": "private_0x000000007e2b7000", "norm_filename": null, "region_type": "private_memory", "start_va": 2116775936, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2116800512, "type": "region", "version": 1 }, "end_va": 2116812799, "entry_point": 0, "filename": null, "id": "region_2069", "name": "private_0x000000007e2bd000", "norm_filename": null, "region_type": "private_memory", "start_va": 2116800512, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_2070", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138533214945280, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138535362363391, "entry_point": 0, "filename": null, "id": "region_2071", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138535362363392, "type": "region", "version": 1 }, "end_va": 140734385618943, "entry_point": 0, "filename": null, "id": "region_2072", "name": "pagefile_0x00007dff47100000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138535362363392, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140734385618944, "type": "region", "version": 1 }, "end_va": 140734387462143, "entry_point": 140734385618944, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_2073", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140734385618944, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3100827648, "start_va": 140734387462144, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_2074", "name": "private_0x00007fff472c2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140734387462144, "timestamp": "00:03:04.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 8257536, "type": "region", "version": 1 }, "end_va": 8323071, "entry_point": 0, "filename": null, "id": "region_2075", "name": "private_0x00000000007e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 8257536, "timestamp": "00:03:04.658", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1988624384, "type": "region", "version": 1 }, "end_va": 1988947967, "entry_point": 1988624384, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_2076", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1988624384, "timestamp": "00:03:04.658", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1988952064, "type": "region", "version": 1 }, "end_va": 1989423103, "entry_point": 1988952064, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_2077", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1988952064, "timestamp": "00:03:04.658", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 9699328, "type": "region", "version": 1 }, "end_va": 10747903, "entry_point": 0, "filename": null, "id": "region_2078", "name": "private_0x0000000000940000", "norm_filename": null, "region_type": "private_memory", "start_va": 9699328, "timestamp": "00:03:04.666", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1988558848, "type": "region", "version": 1 }, "end_va": 1988591615, "entry_point": 1988558848, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_2079", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1988558848, "timestamp": "00:03:04.667", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 6160384, "type": "region", "version": 1 }, "end_va": 6225919, "entry_point": 0, "filename": null, "id": "region_2080", "name": "pagefile_0x00000000005e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6160384, "timestamp": "00:03:04.689", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 6225920, "type": "region", "version": 1 }, "end_va": 6242303, "entry_point": 0, "filename": null, "id": "region_2081", "name": "private_0x00000000005f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6225920, "timestamp": "00:03:04.689", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 7208960, "type": "region", "version": 1 }, "end_va": 7987199, "entry_point": 7208960, "filename": "\\Windows\\System32\\locale.nls", "id": "region_2082", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 7208960, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 7995392, "type": "region", "version": 1 }, "end_va": 8257535, "entry_point": 0, "filename": null, "id": "region_2083", "name": "private_0x00000000007a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 7995392, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 8323072, "type": "region", "version": 1 }, "end_va": 8585215, "entry_point": 0, "filename": null, "id": "region_2084", "name": "private_0x00000000007f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 8323072, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 9371648, "type": "region", "version": 1 }, "end_va": 9437183, "entry_point": 0, "filename": null, "id": "region_2085", "name": "private_0x00000000008f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 9371648, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1946484736, "type": "region", "version": 1 }, "end_va": 1946849279, "entry_point": 1946484736, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_2086", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1946484736, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1946877952, "type": "region", "version": 1 }, "end_va": 1946918911, "entry_point": 1946877952, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_2087", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1946877952, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1946943488, "type": "region", "version": 1 }, "end_va": 1947066367, "entry_point": 1946943488, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_2088", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1946943488, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1951006720, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951006720, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_2089", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1951006720, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1951793152, "type": "region", "version": 1 }, "end_va": 1952067583, "entry_point": 1951793152, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_2090", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1951793152, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1953431552, "type": "region", "version": 1 }, "end_va": 1954963455, "entry_point": 1953431552, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_2091", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1953431552, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1956511744, "type": "region", "version": 1 }, "end_va": 1957216255, "entry_point": 1956511744, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_2092", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1956511744, "timestamp": "00:03:04.690", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 1979514880, "type": "region", "version": 1 }, "end_va": 1979543551, "entry_point": 1979514880, "filename": "\\Windows\\SysWOW64\\nsi.dll", "id": "region_2093", "name": "nsi.dll", "norm_filename": "c:\\windows\\syswow64\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 1979514880, "timestamp": "00:03:04.691", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1982464000, "type": "region", "version": 1 }, "end_va": 1983447039, "entry_point": 1982464000, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_2094", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1982464000, "timestamp": "00:03:04.691", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1992622080, "type": "region", "version": 1 }, "end_va": 1993125887, "entry_point": 1992622080, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_2095", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1992622080, "timestamp": "00:03:04.691", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 376832, "start_va": 1994915840, "type": "region", "version": 1 }, "end_va": 1995292671, "entry_point": 1994915840, "filename": "\\Windows\\SysWOW64\\ws2_32.dll", "id": "region_2096", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\syswow64\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 1994915840, "timestamp": "00:03:04.691", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2115567616, "type": "region", "version": 1 }, "end_va": 2116616191, "entry_point": 0, "filename": null, "id": "region_2097", "name": "pagefile_0x000000007e190000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2115567616, "timestamp": "00:03:04.691", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2116788224, "type": "region", "version": 1 }, "end_va": 2116800511, "entry_point": 0, "filename": null, "id": "region_2098", "name": "private_0x000000007e2ba000", "norm_filename": null, "region_type": "private_memory", "start_va": 2116788224, "timestamp": "00:03:04.691", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 10747904, "type": "region", "version": 1 }, "end_va": 14118911, "entry_point": 10747904, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_2099", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 10747904, "timestamp": "00:03:04.693", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 40960, "start_va": 6291456, "type": "region", "version": 1 }, "end_va": 6332415, "entry_point": 6291456, "filename": "\\Windows\\SysWOW64\\en-US\\reg.exe.mui", "id": "region_2100", "name": "reg.exe.mui", "norm_filename": "c:\\windows\\syswow64\\en-us\\reg.exe.mui", "region_type": "memory_mapped_file", "start_va": 6291456, "timestamp": "00:03:04.701", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f", "filename": "c:\\windows\\syswow64\\reg.exe", "id": "proc_18", "image_name": "reg.exe", "monitor_reason": "child_process", "monitored_id": 18, "origin_monitor_id": 13, "ref_parent_process": { "ref_id": "proc_13", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 9961472, "type": "region", "version": 1 }, "end_va": 10092543, "entry_point": 0, "filename": null, "id": "region_2101", "name": "private_0x0000000000980000", "norm_filename": null, "region_type": "private_memory", "start_va": 9961472, "timestamp": "00:03:04.753", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 10092544, "type": "region", "version": 1 }, "end_va": 10100735, "entry_point": 0, "filename": null, "id": "region_2102", "name": "private_0x00000000009a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 10092544, "timestamp": "00:03:04.753", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 10158080, "type": "region", "version": 1 }, "end_va": 10239999, "entry_point": 0, "filename": null, "id": "region_2103", "name": "pagefile_0x00000000009b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10158080, "timestamp": "00:03:04.753", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 10289152, "type": "region", "version": 1 }, "end_va": 10551295, "entry_point": 0, "filename": null, "id": "region_2104", "name": "private_0x00000000009d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 10289152, "timestamp": "00:03:04.753", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 10551296, "type": "region", "version": 1 }, "end_va": 10813439, "entry_point": 0, "filename": null, "id": "region_2105", "name": "private_0x0000000000a10000", "norm_filename": null, "region_type": "private_memory", "start_va": 10551296, "timestamp": "00:03:04.753", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 10813440, "type": "region", "version": 1 }, "end_va": 10829823, "entry_point": 0, "filename": null, "id": "region_2106", "name": "pagefile_0x0000000000a50000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10813440, "timestamp": "00:03:04.753", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 10878976, "type": "region", "version": 1 }, "end_va": 10883071, "entry_point": 0, "filename": null, "id": "region_2107", "name": "pagefile_0x0000000000a60000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10878976, "timestamp": "00:03:04.753", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 10944512, "type": "region", "version": 1 }, "end_va": 10952703, "entry_point": 0, "filename": null, "id": "region_2108", "name": "private_0x0000000000a70000", "norm_filename": null, "region_type": "private_memory", "start_va": 10944512, "timestamp": "00:03:04.753", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 339968, "start_va": 14876672, "type": "region", "version": 1 }, "end_va": 15216639, "entry_point": 14876672, "filename": "\\Windows\\SysWOW64\\reg.exe", "id": "region_2109", "name": "reg.exe", "norm_filename": "c:\\windows\\syswow64\\reg.exe", "region_type": "memory_mapped_file", "start_va": 14876672, "timestamp": "00:03:04.753", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 15269888, "type": "region", "version": 1 }, "end_va": 82378751, "entry_point": 0, "filename": null, "id": "region_2110", "name": "pagefile_0x0000000000e90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 15269888, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1997078528, "type": "region", "version": 1 }, "end_va": 1998622719, "entry_point": 1997078528, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_2111", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1997078528, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2119630848, "type": "region", "version": 1 }, "end_va": 2119774207, "entry_point": 0, "filename": null, "id": "region_2112", "name": "pagefile_0x000000007e570000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2119630848, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2119774208, "type": "region", "version": 1 }, "end_va": 2119778303, "entry_point": 0, "filename": null, "id": "region_2113", "name": "private_0x000000007e593000", "norm_filename": null, "region_type": "private_memory", "start_va": 2119774208, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2119786496, "type": "region", "version": 1 }, "end_va": 2119790591, "entry_point": 0, "filename": null, "id": "region_2114", "name": "private_0x000000007e596000", "norm_filename": null, "region_type": "private_memory", "start_va": 2119786496, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2119815168, "type": "region", "version": 1 }, "end_va": 2119827455, "entry_point": 0, "filename": null, "id": "region_2115", "name": "private_0x000000007e59d000", "norm_filename": null, "region_type": "private_memory", "start_va": 2119815168, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_2116", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138533214945280, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138535362363391, "entry_point": 0, "filename": null, "id": "region_2117", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138535362363392, "type": "region", "version": 1 }, "end_va": 140734385618943, "entry_point": 0, "filename": null, "id": "region_2118", "name": "pagefile_0x00007dff47100000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138535362363392, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140734385618944, "type": "region", "version": 1 }, "end_va": 140734387462143, "entry_point": 140734385618944, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_2119", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140734385618944, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3100827648, "start_va": 140734387462144, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_2120", "name": "private_0x00007fff472c2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140734387462144, "timestamp": "00:03:04.755", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 12320768, "type": "region", "version": 1 }, "end_va": 12386303, "entry_point": 0, "filename": null, "id": "region_2121", "name": "private_0x0000000000bc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 12320768, "timestamp": "00:03:04.764", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1988624384, "type": "region", "version": 1 }, "end_va": 1988947967, "entry_point": 1988624384, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_2122", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1988624384, "timestamp": "00:03:04.764", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1988952064, "type": "region", "version": 1 }, "end_va": 1989423103, "entry_point": 1988952064, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_2123", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1988952064, "timestamp": "00:03:04.764", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 12845056, "type": "region", "version": 1 }, "end_va": 13893631, "entry_point": 0, "filename": null, "id": "region_2124", "name": "private_0x0000000000c40000", "norm_filename": null, "region_type": "private_memory", "start_va": 12845056, "timestamp": "00:03:04.781", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1988558848, "type": "region", "version": 1 }, "end_va": 1988591615, "entry_point": 1988558848, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_2125", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1988558848, "timestamp": "00:03:04.781", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 9961472, "type": "region", "version": 1 }, "end_va": 10027007, "entry_point": 0, "filename": null, "id": "region_2126", "name": "pagefile_0x0000000000980000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 9961472, "timestamp": "00:03:04.804", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 10027008, "type": "region", "version": 1 }, "end_va": 10043391, "entry_point": 0, "filename": null, "id": "region_2127", "name": "private_0x0000000000990000", "norm_filename": null, "region_type": "private_memory", "start_va": 10027008, "timestamp": "00:03:04.804", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 11010048, "type": "region", "version": 1 }, "end_va": 11788287, "entry_point": 11010048, "filename": "\\Windows\\System32\\locale.nls", "id": "region_2128", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 11010048, "timestamp": "00:03:04.804", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 11796480, "type": "region", "version": 1 }, "end_va": 12058623, "entry_point": 0, "filename": null, "id": "region_2129", "name": "private_0x0000000000b40000", "norm_filename": null, "region_type": "private_memory", "start_va": 11796480, "timestamp": "00:03:04.804", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 12058624, "type": "region", "version": 1 }, "end_va": 12320767, "entry_point": 0, "filename": null, "id": "region_2130", "name": "private_0x0000000000b80000", "norm_filename": null, "region_type": "private_memory", "start_va": 12058624, "timestamp": "00:03:04.804", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 12713984, "type": "region", "version": 1 }, "end_va": 12779519, "entry_point": 0, "filename": null, "id": "region_2131", "name": "private_0x0000000000c20000", "norm_filename": null, "region_type": "private_memory", "start_va": 12713984, "timestamp": "00:03:04.804", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1946484736, "type": "region", "version": 1 }, "end_va": 1946849279, "entry_point": 1946484736, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_2132", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1946484736, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1946877952, "type": "region", "version": 1 }, "end_va": 1946918911, "entry_point": 1946877952, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_2133", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1946877952, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1946943488, "type": "region", "version": 1 }, "end_va": 1947066367, "entry_point": 1946943488, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_2134", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1946943488, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1951006720, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951006720, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_2135", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1951006720, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1951793152, "type": "region", "version": 1 }, "end_va": 1952067583, "entry_point": 1951793152, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_2136", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1951793152, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1953431552, "type": "region", "version": 1 }, "end_va": 1954963455, "entry_point": 1953431552, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_2137", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1953431552, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1956511744, "type": "region", "version": 1 }, "end_va": 1957216255, "entry_point": 1956511744, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_2138", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1956511744, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 1979514880, "type": "region", "version": 1 }, "end_va": 1979543551, "entry_point": 1979514880, "filename": "\\Windows\\SysWOW64\\nsi.dll", "id": "region_2139", "name": "nsi.dll", "norm_filename": "c:\\windows\\syswow64\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 1979514880, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1982464000, "type": "region", "version": 1 }, "end_va": 1983447039, "entry_point": 1982464000, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_2140", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1982464000, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1992622080, "type": "region", "version": 1 }, "end_va": 1993125887, "entry_point": 1992622080, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_2141", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1992622080, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 376832, "start_va": 1994915840, "type": "region", "version": 1 }, "end_va": 1995292671, "entry_point": 1994915840, "filename": "\\Windows\\SysWOW64\\ws2_32.dll", "id": "region_2142", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\syswow64\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 1994915840, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2118582272, "type": "region", "version": 1 }, "end_va": 2119630847, "entry_point": 0, "filename": null, "id": "region_2143", "name": "pagefile_0x000000007e470000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2118582272, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2119802880, "type": "region", "version": 1 }, "end_va": 2119815167, "entry_point": 0, "filename": null, "id": "region_2144", "name": "private_0x000000007e59a000", "norm_filename": null, "region_type": "private_memory", "start_va": 2119802880, "timestamp": "00:03:04.805", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 82378752, "type": "region", "version": 1 }, "end_va": 85749759, "entry_point": 82378752, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_2145", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 82378752, "timestamp": "00:03:04.806", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 40960, "start_va": 10092544, "type": "region", "version": 1 }, "end_va": 10133503, "entry_point": 10092544, "filename": "\\Windows\\SysWOW64\\en-US\\reg.exe.mui", "id": "region_2146", "name": "reg.exe.mui", "norm_filename": "c:\\windows\\syswow64\\en-us\\reg.exe.mui", "region_type": "memory_mapped_file", "start_va": 10092544, "timestamp": "00:03:04.813", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"", "filename": "c:\\windows\\syswow64\\reg.exe", "id": "proc_19", "image_name": "reg.exe", "monitor_reason": "child_process", "monitored_id": 19, "origin_monitor_id": 13, "ref_parent_process": { "ref_id": "proc_13", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 5570560, "type": "region", "version": 1 }, "end_va": 5701631, "entry_point": 0, "filename": null, "id": "region_2147", "name": "private_0x0000000000550000", "norm_filename": null, "region_type": "private_memory", "start_va": 5570560, "timestamp": "00:03:04.834", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 5701632, "type": "region", "version": 1 }, "end_va": 5709823, "entry_point": 0, "filename": null, "id": "region_2148", "name": "private_0x0000000000570000", "norm_filename": null, "region_type": "private_memory", "start_va": 5701632, "timestamp": "00:03:04.834", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 5767168, "type": "region", "version": 1 }, "end_va": 5849087, "entry_point": 0, "filename": null, "id": "region_2149", "name": "pagefile_0x0000000000580000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5767168, "timestamp": "00:03:04.834", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 5898240, "type": "region", "version": 1 }, "end_va": 6160383, "entry_point": 0, "filename": null, "id": "region_2150", "name": "private_0x00000000005a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 5898240, "timestamp": "00:03:04.834", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 6160384, "type": "region", "version": 1 }, "end_va": 6422527, "entry_point": 0, "filename": null, "id": "region_2151", "name": "private_0x00000000005e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6160384, "timestamp": "00:03:04.834", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 6422528, "type": "region", "version": 1 }, "end_va": 6438911, "entry_point": 0, "filename": null, "id": "region_2152", "name": "pagefile_0x0000000000620000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6422528, "timestamp": "00:03:04.834", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 6488064, "type": "region", "version": 1 }, "end_va": 6492159, "entry_point": 0, "filename": null, "id": "region_2153", "name": "pagefile_0x0000000000630000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6488064, "timestamp": "00:03:04.834", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 6553600, "type": "region", "version": 1 }, "end_va": 6561791, "entry_point": 0, "filename": null, "id": "region_2154", "name": "private_0x0000000000640000", "norm_filename": null, "region_type": "private_memory", "start_va": 6553600, "timestamp": "00:03:04.834", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 339968, "start_va": 14876672, "type": "region", "version": 1 }, "end_va": 15216639, "entry_point": 14876672, "filename": "\\Windows\\SysWOW64\\reg.exe", "id": "region_2155", "name": "reg.exe", "norm_filename": "c:\\windows\\syswow64\\reg.exe", "region_type": "memory_mapped_file", "start_va": 14876672, "timestamp": "00:03:04.834", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 15269888, "type": "region", "version": 1 }, "end_va": 82378751, "entry_point": 0, "filename": null, "id": "region_2156", "name": "pagefile_0x0000000000e90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 15269888, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1997078528, "type": "region", "version": 1 }, "end_va": 1998622719, "entry_point": 1997078528, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_2157", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1997078528, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2129526784, "type": "region", "version": 1 }, "end_va": 2129670143, "entry_point": 0, "filename": null, "id": "region_2158", "name": "pagefile_0x000000007eee0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2129526784, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2129702912, "type": "region", "version": 1 }, "end_va": 2129715199, "entry_point": 0, "filename": null, "id": "region_2159", "name": "private_0x000000007ef0b000", "norm_filename": null, "region_type": "private_memory", "start_va": 2129702912, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2129715200, "type": "region", "version": 1 }, "end_va": 2129719295, "entry_point": 0, "filename": null, "id": "region_2160", "name": "private_0x000000007ef0e000", "norm_filename": null, "region_type": "private_memory", "start_va": 2129715200, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2129719296, "type": "region", "version": 1 }, "end_va": 2129723391, "entry_point": 0, "filename": null, "id": "region_2161", "name": "private_0x000000007ef0f000", "norm_filename": null, "region_type": "private_memory", "start_va": 2129719296, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_2162", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138533214945280, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138535362363391, "entry_point": 0, "filename": null, "id": "region_2163", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138535362363392, "type": "region", "version": 1 }, "end_va": 140734385618943, "entry_point": 0, "filename": null, "id": "region_2164", "name": "pagefile_0x00007dff47100000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138535362363392, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140734385618944, "type": "region", "version": 1 }, "end_va": 140734387462143, "entry_point": 140734385618944, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_2165", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140734385618944, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3100827648, "start_va": 140734387462144, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_2166", "name": "private_0x00007fff472c2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140734387462144, "timestamp": "00:03:04.836", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 6815744, "type": "region", "version": 1 }, "end_va": 6881279, "entry_point": 0, "filename": null, "id": "region_2167", "name": "private_0x0000000000680000", "norm_filename": null, "region_type": "private_memory", "start_va": 6815744, "timestamp": "00:03:04.844", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1988624384, "type": "region", "version": 1 }, "end_va": 1988947967, "entry_point": 1988624384, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_2168", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1988624384, "timestamp": "00:03:04.844", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1988952064, "type": "region", "version": 1 }, "end_va": 1989423103, "entry_point": 1988952064, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_2169", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1988952064, "timestamp": "00:03:04.844", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 8519680, "type": "region", "version": 1 }, "end_va": 9568255, "entry_point": 0, "filename": null, "id": "region_2170", "name": "private_0x0000000000820000", "norm_filename": null, "region_type": "private_memory", "start_va": 8519680, "timestamp": "00:03:04.852", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1988558848, "type": "region", "version": 1 }, "end_va": 1988591615, "entry_point": 1988558848, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_2171", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1988558848, "timestamp": "00:03:04.852", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 5570560, "type": "region", "version": 1 }, "end_va": 5636095, "entry_point": 0, "filename": null, "id": "region_2172", "name": "pagefile_0x0000000000550000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5570560, "timestamp": "00:03:04.873", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 5636096, "type": "region", "version": 1 }, "end_va": 5652479, "entry_point": 0, "filename": null, "id": "region_2173", "name": "private_0x0000000000560000", "norm_filename": null, "region_type": "private_memory", "start_va": 5636096, "timestamp": "00:03:04.873", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 6881280, "type": "region", "version": 1 }, "end_va": 7659519, "entry_point": 6881280, "filename": "\\Windows\\System32\\locale.nls", "id": "region_2174", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 6881280, "timestamp": "00:03:04.873", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 7667712, "type": "region", "version": 1 }, "end_va": 7929855, "entry_point": 0, "filename": null, "id": "region_2175", "name": "private_0x0000000000750000", "norm_filename": null, "region_type": "private_memory", "start_va": 7667712, "timestamp": "00:03:04.873", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 7929856, "type": "region", "version": 1 }, "end_va": 8191999, "entry_point": 0, "filename": null, "id": "region_2176", "name": "private_0x0000000000790000", "norm_filename": null, "region_type": "private_memory", "start_va": 7929856, "timestamp": "00:03:04.873", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 11010048, "type": "region", "version": 1 }, "end_va": 11075583, "entry_point": 0, "filename": null, "id": "region_2177", "name": "private_0x0000000000a80000", "norm_filename": null, "region_type": "private_memory", "start_va": 11010048, "timestamp": "00:03:04.873", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1946484736, "type": "region", "version": 1 }, "end_va": 1946849279, "entry_point": 1946484736, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_2178", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1946484736, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1946877952, "type": "region", "version": 1 }, "end_va": 1946918911, "entry_point": 1946877952, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_2179", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1946877952, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1946943488, "type": "region", "version": 1 }, "end_va": 1947066367, "entry_point": 1946943488, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_2180", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1946943488, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1951006720, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951006720, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_2181", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1951006720, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1951793152, "type": "region", "version": 1 }, "end_va": 1952067583, "entry_point": 1951793152, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_2182", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1951793152, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1953431552, "type": "region", "version": 1 }, "end_va": 1954963455, "entry_point": 1953431552, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_2183", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1953431552, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1956511744, "type": "region", "version": 1 }, "end_va": 1957216255, "entry_point": 1956511744, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_2184", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1956511744, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 1979514880, "type": "region", "version": 1 }, "end_va": 1979543551, "entry_point": 1979514880, "filename": "\\Windows\\SysWOW64\\nsi.dll", "id": "region_2185", "name": "nsi.dll", "norm_filename": "c:\\windows\\syswow64\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 1979514880, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1982464000, "type": "region", "version": 1 }, "end_va": 1983447039, "entry_point": 1982464000, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_2186", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1982464000, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1992622080, "type": "region", "version": 1 }, "end_va": 1993125887, "entry_point": 1992622080, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_2187", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1992622080, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 376832, "start_va": 1994915840, "type": "region", "version": 1 }, "end_va": 1995292671, "entry_point": 1994915840, "filename": "\\Windows\\SysWOW64\\ws2_32.dll", "id": "region_2188", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\syswow64\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 1994915840, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2128478208, "type": "region", "version": 1 }, "end_va": 2129526783, "entry_point": 0, "filename": null, "id": "region_2189", "name": "pagefile_0x000000007ede0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2128478208, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2129690624, "type": "region", "version": 1 }, "end_va": 2129702911, "entry_point": 0, "filename": null, "id": "region_2190", "name": "private_0x000000007ef08000", "norm_filename": null, "region_type": "private_memory", "start_va": 2129690624, "timestamp": "00:03:04.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 11075584, "type": "region", "version": 1 }, "end_va": 14446591, "entry_point": 11075584, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_2191", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 11075584, "timestamp": "00:03:04.875", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 9568256, "type": "region", "version": 1 }, "end_va": 10481663, "entry_point": 9568256, "filename": "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui", "id": "region_2192", "name": "kernelbase.dll.mui", "norm_filename": "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui", "region_type": "memory_mapped_file", "start_va": 9568256, "timestamp": "00:03:04.883", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "attrib Default.rdp -s -h", "filename": "c:\\windows\\syswow64\\attrib.exe", "id": "proc_20", "image_name": "attrib.exe", "monitor_reason": "child_process", "monitored_id": 20, "origin_monitor_id": 13, "ref_parent_process": { "ref_id": "proc_13", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 6356992, "type": "region", "version": 1 }, "end_va": 6488063, "entry_point": 0, "filename": null, "id": "region_2193", "name": "private_0x0000000000610000", "norm_filename": null, "region_type": "private_memory", "start_va": 6356992, "timestamp": "00:03:04.925", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 6488064, "type": "region", "version": 1 }, "end_va": 6496255, "entry_point": 0, "filename": null, "id": "region_2194", "name": "private_0x0000000000630000", "norm_filename": null, "region_type": "private_memory", "start_va": 6488064, "timestamp": "00:03:04.925", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 6553600, "type": "region", "version": 1 }, "end_va": 6635519, "entry_point": 0, "filename": null, "id": "region_2195", "name": "pagefile_0x0000000000640000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6553600, "timestamp": "00:03:04.925", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 6684672, "type": "region", "version": 1 }, "end_va": 6946815, "entry_point": 0, "filename": null, "id": "region_2196", "name": "private_0x0000000000660000", "norm_filename": null, "region_type": "private_memory", "start_va": 6684672, "timestamp": "00:03:04.925", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 6946816, "type": "region", "version": 1 }, "end_va": 7208959, "entry_point": 0, "filename": null, "id": "region_2197", "name": "private_0x00000000006a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6946816, "timestamp": "00:03:04.925", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 7208960, "type": "region", "version": 1 }, "end_va": 7225343, "entry_point": 0, "filename": null, "id": "region_2198", "name": "pagefile_0x00000000006e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7208960, "timestamp": "00:03:04.925", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 7274496, "type": "region", "version": 1 }, "end_va": 7278591, "entry_point": 0, "filename": null, "id": "region_2199", "name": "pagefile_0x00000000006f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7274496, "timestamp": "00:03:04.925", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 7340032, "type": "region", "version": 1 }, "end_va": 7348223, "entry_point": 0, "filename": null, "id": "region_2200", "name": "private_0x0000000000700000", "norm_filename": null, "region_type": "private_memory", "start_va": 7340032, "timestamp": "00:03:04.925", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 36864, "start_va": 9895936, "type": "region", "version": 1 }, "end_va": 9932799, "entry_point": 9895936, "filename": "\\Windows\\SysWOW64\\attrib.exe", "id": "region_2201", "name": "attrib.exe", "norm_filename": "c:\\windows\\syswow64\\attrib.exe", "region_type": "memory_mapped_file", "start_va": 9895936, "timestamp": "00:03:04.925", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 9961472, "type": "region", "version": 1 }, "end_va": 77070335, "entry_point": 0, "filename": null, "id": "region_2202", "name": "pagefile_0x0000000000980000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 9961472, "timestamp": "00:03:04.967", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1997078528, "type": "region", "version": 1 }, "end_va": 1998622719, "entry_point": 1997078528, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_2203", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1997078528, "timestamp": "00:03:04.967", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2127298560, "type": "region", "version": 1 }, "end_va": 2127441919, "entry_point": 0, "filename": null, "id": "region_2204", "name": "pagefile_0x000000007ecc0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2127298560, "timestamp": "00:03:04.967", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2127454208, "type": "region", "version": 1 }, "end_va": 2127458303, "entry_point": 0, "filename": null, "id": "region_2205", "name": "private_0x000000007ece6000", "norm_filename": null, "region_type": "private_memory", "start_va": 2127454208, "timestamp": "00:03:04.967", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2127462400, "type": "region", "version": 1 }, "end_va": 2127466495, "entry_point": 0, "filename": null, "id": "region_2206", "name": "private_0x000000007ece8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2127462400, "timestamp": "00:03:04.967", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2127482880, "type": "region", "version": 1 }, "end_va": 2127495167, "entry_point": 0, "filename": null, "id": "region_2207", "name": "private_0x000000007eced000", "norm_filename": null, "region_type": "private_memory", "start_va": 2127482880, "timestamp": "00:03:04.967", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_2208", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:03:04.967", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138533214945280, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138535362363391, "entry_point": 0, "filename": null, "id": "region_2209", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:03:04.967", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138535362363392, "type": "region", "version": 1 }, "end_va": 140734385618943, "entry_point": 0, "filename": null, "id": "region_2210", "name": "pagefile_0x00007dff47100000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138535362363392, "timestamp": "00:03:04.967", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140734385618944, "type": "region", "version": 1 }, "end_va": 140734387462143, "entry_point": 140734385618944, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_2211", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140734385618944, "timestamp": "00:03:04.968", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3100827648, "start_va": 140734387462144, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_2212", "name": "private_0x00007fff472c2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140734387462144, "timestamp": "00:03:04.968", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 7864320, "type": "region", "version": 1 }, "end_va": 7929855, "entry_point": 0, "filename": null, "id": "region_2213", "name": "private_0x0000000000780000", "norm_filename": null, "region_type": "private_memory", "start_va": 7864320, "timestamp": "00:03:04.977", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1988624384, "type": "region", "version": 1 }, "end_va": 1988947967, "entry_point": 1988624384, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_2214", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1988624384, "timestamp": "00:03:04.977", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1988952064, "type": "region", "version": 1 }, "end_va": 1989423103, "entry_point": 1988952064, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_2215", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1988952064, "timestamp": "00:03:04.977", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 8716288, "type": "region", "version": 1 }, "end_va": 9764863, "entry_point": 0, "filename": null, "id": "region_2216", "name": "private_0x0000000000850000", "norm_filename": null, "region_type": "private_memory", "start_va": 8716288, "timestamp": "00:03:05.012", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1988558848, "type": "region", "version": 1 }, "end_va": 1988591615, "entry_point": 1988558848, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_2217", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1988558848, "timestamp": "00:03:05.012", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 6356992, "type": "region", "version": 1 }, "end_va": 6422527, "entry_point": 0, "filename": null, "id": "region_2258", "name": "pagefile_0x0000000000610000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6356992, "timestamp": "00:03:05.079", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 7405568, "type": "region", "version": 1 }, "end_va": 7667711, "entry_point": 0, "filename": null, "id": "region_2259", "name": "private_0x0000000000710000", "norm_filename": null, "region_type": "private_memory", "start_va": 7405568, "timestamp": "00:03:05.079", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 7929856, "type": "region", "version": 1 }, "end_va": 8708095, "entry_point": 7929856, "filename": "\\Windows\\System32\\locale.nls", "id": "region_2260", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 7929856, "timestamp": "00:03:05.079", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 77070336, "type": "region", "version": 1 }, "end_va": 77332479, "entry_point": 0, "filename": null, "id": "region_2261", "name": "private_0x0000000004980000", "norm_filename": null, "region_type": "private_memory", "start_va": 77070336, "timestamp": "00:03:05.079", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 78184448, "type": "region", "version": 1 }, "end_va": 78249983, "entry_point": 0, "filename": null, "id": "region_2262", "name": "private_0x0000000004a90000", "norm_filename": null, "region_type": "private_memory", "start_va": 78184448, "timestamp": "00:03:05.079", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 159744, "start_va": 1946222592, "type": "region", "version": 1 }, "end_va": 1946382335, "entry_point": 1946222592, "filename": "\\Windows\\SysWOW64\\ulib.dll", "id": "region_2263", "name": "ulib.dll", "norm_filename": "c:\\windows\\syswow64\\ulib.dll", "region_type": "memory_mapped_file", "start_va": 1946222592, "timestamp": "00:03:05.079", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1951006720, "type": "region", "version": 1 }, "end_va": 1951784959, "entry_point": 1951006720, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_2264", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1951006720, "timestamp": "00:03:05.083", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1953431552, "type": "region", "version": 1 }, "end_va": 1954963455, "entry_point": 1953431552, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_2265", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1953431552, "timestamp": "00:03:05.083", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1982464000, "type": "region", "version": 1 }, "end_va": 1983447039, "entry_point": 1982464000, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_2266", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1982464000, "timestamp": "00:03:05.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2126249984, "type": "region", "version": 1 }, "end_va": 2127298559, "entry_point": 0, "filename": null, "id": "region_2267", "name": "pagefile_0x000000007ebc0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2126249984, "timestamp": "00:03:05.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2127470592, "type": "region", "version": 1 }, "end_va": 2127482879, "entry_point": 0, "filename": null, "id": "region_2268", "name": "private_0x000000007ecea000", "norm_filename": null, "region_type": "private_memory", "start_va": 2127470592, "timestamp": "00:03:05.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 6422528, "type": "region", "version": 1 }, "end_va": 6438911, "entry_point": 0, "filename": null, "id": "region_2269", "name": "private_0x0000000000620000", "norm_filename": null, "region_type": "private_memory", "start_va": 6422528, "timestamp": "00:03:05.126", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 6488064, "type": "region", "version": 1 }, "end_va": 6504447, "entry_point": 0, "filename": null, "id": "region_2270", "name": "private_0x0000000000630000", "norm_filename": null, "region_type": "private_memory", "start_va": 6488064, "timestamp": "00:03:05.126", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1946157056, "type": "region", "version": 1 }, "end_va": 1946198015, "entry_point": 1946157056, "filename": "\\Windows\\SysWOW64\\fsutilext.dll", "id": "region_2271", "name": "fsutilext.dll", "norm_filename": "c:\\windows\\syswow64\\fsutilext.dll", "region_type": "memory_mapped_file", "start_va": 1946157056, "timestamp": "00:03:05.127", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 } ], "remarks": { "critical": [], "non_critical": [ { "comment": "The maximum number of extracted files was reached during the analysis. Some files may be missing in the reports. You can increase the limit in the configuration.", "id": 1024, "type": "remark", "version": 1 }, { "comment": "The dump total size limit was reached during the analysis. Some memory dump may be missing in the reports. You can increase the limit in the configuration.", "id": 512, "type": "remark", "version": 1 }, { "comment": "The operating system was rebooted during the analysis.", "id": 128, "type": "remark", "version": 1 }, { "comment": "The maximum number of dumps was reached during the analysis. Some memory dumps may be missing in the reports. You can increase the limit in the configuration.", "id": 2048, "type": "remark", "version": 1 } ], "type": "remarks", "version": 1 }, "sample_details": { "filename": "MSC000000981631.vbs", "id": 20392, "md5_hash": "22f0830e8954547036afb0df08283b18", "sample_type": "vbscript", "sha1_hash": "d18a0df0bd2393221f0bbd17e48d6c4ac1ea28f6", "sha256_hash": "7a18bffd01eeab08a3f88d35ba5d09106690ea62d01e43d950b6b842ab6c4e76", "size": 4818, "type": "sample_details", "version": 1 }, "screenshots": [ { "screenshot_archive_path": "screenshots/screenshot_0.png", "size": 534704, "thumbnail_archive_path": "screenshots/thumbnail_0.png", "timestamp": "00:00:00.000", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_13132.png", "size": 282422, "thumbnail_archive_path": "screenshots/thumbnail_13132.png", "timestamp": "00:00:13.132", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_14881.png", "size": 534697, "thumbnail_archive_path": "screenshots/thumbnail_14881.png", "timestamp": "00:00:14.881", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_18918.png", "size": 321030, "thumbnail_archive_path": "screenshots/thumbnail_18918.png", "timestamp": "00:00:18.918", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_26566.png", "size": 309705, "thumbnail_archive_path": "screenshots/thumbnail_26566.png", "timestamp": "00:00:26.566", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_37697.png", "size": 540772, "thumbnail_archive_path": "screenshots/thumbnail_37697.png", "timestamp": "00:00:37.697", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_38725.png", "size": 535905, "thumbnail_archive_path": "screenshots/thumbnail_38725.png", "timestamp": "00:00:38.725", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_39916.png", "size": 528663, "thumbnail_archive_path": "screenshots/thumbnail_39916.png", "timestamp": "00:00:39.916", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_53763.png", "size": 519613, "thumbnail_archive_path": "screenshots/thumbnail_53763.png", "timestamp": "00:00:53.763", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_57772.png", "size": 524198, "thumbnail_archive_path": "screenshots/thumbnail_57772.png", "timestamp": "00:00:57.772", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_58772.png", "size": 8493, "thumbnail_archive_path": "screenshots/thumbnail_58772.png", "timestamp": "00:00:58.772", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_82660.png", "size": 3848, "thumbnail_archive_path": "screenshots/thumbnail_82660.png", "timestamp": "00:01:22.660", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_88826.png", "size": 8437, "thumbnail_archive_path": "screenshots/thumbnail_88826.png", "timestamp": "00:01:28.826", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_89848.png", "size": 458836, "thumbnail_archive_path": "screenshots/thumbnail_89848.png", "timestamp": "00:01:29.848", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_98956.png", "size": 519437, "thumbnail_archive_path": "screenshots/thumbnail_98956.png", "timestamp": "00:01:38.956", "type": "screenshot", "version": 1 } ], "type": "summary", "version": 1, "vm_and_analyzer_details": { "adobe_acrobat_reader_version": "not_installed", "analyzer_build_date": "2017-12-05 14:47", "analyzer_version": "2.2.0", "chrome_version": "58.0.3029.110", "firefox_version": "53.0.3", "flash_version": "25.0.0.148", "internet_explorer_version": "11.0.10240.16384", "java_version": "8.0.1310.11", "microsoft_excel_version": "not_installed", "microsoft_office_version": "not_installed", "microsoft_power_point_version": "not_installed", "microsoft_project_version": "not_installed", "microsoft_publisher_version": "not_installed", "microsoft_visio_version": "not_installed", "microsoft_word_version": "not_installed", "silverlight_version": "not_installed", "type": "vm_and_analyzer_details", "version": 1, "vm_architecture": "x86_64-bit", "vm_kernel_version": "10.0.10240.16384_(c68ee22f-dcf6-4778-95c5-4a862be16567)", "vm_name": null, "vm_os": "windows_10_threshold_1" }, "vti": { "type": "vti", "version": 1, "vti_built_in_rules_version": "2.6", "vti_rule_matches": [ { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_read_from_remote_process", "operation_desc": "Read from memory of another process", "ref_gfncalls": [ { "ref_id": "gfn_514", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_read_from_remote_process", "technique_desc": "\"c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe\" reads from \"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\vwOrbzLbc.exe\".", "technique_path": "built_in._process._read_from_remote_process.vmray_read_from_remote_process", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [ { "operations": [ "write" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", "type": "registry_artifact", "version": 1 } ], "type": "artifacts", "urls": [], "version": 1 }, "category": "_persistence", "category_desc": "Persistence", "operation": "_install_startup_script", "operation_desc": "Install system startup script or application", "ref_gfncalls": [ { "ref_id": "gfn_591", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_startup_script_by_registry", "technique_desc": "Add \"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vwOrbzLbc.exe\" to windows startup via registry.", "technique_path": "built_in._persistence._install_startup_script.vmray_install_startup_script_by_registry", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\desktop.ini", "hashes": [ { "md5_hash": "03fa1e0ea94f96e88df614abbe0703b1", "sha1_hash": "8b6bf3c2e93724a603abc372e772fd4c8a1a154b", "sha256_hash": "237e277cf6439d70c327f263cb443e4b9f23e1736ec5e38d7e9c5a7490626473", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_643", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\Public\\desktop.ini", "hashes": [ { "md5_hash": "4557a99c5f04dd51e1c57f88eecabfd0", "sha1_hash": "12b9d3fd9c7b25af9f6030245a9bc7b9a306cc6c", "sha256_hash": "87d3ef818691192276efef80fb2d80a1c3f14d4313fe59566429b9a45a62aa82", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_655", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\public\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\Public\\Videos\\desktop.ini", "hashes": [ { "md5_hash": "912937c3c9a69c32211d4162d9199fbc", "sha1_hash": "80e00a9c04a8cb36846da3917dcd095811cd586f", "sha256_hash": "d2f030314ae9d645cb32763ac0b66125eb38d718a64fddc090376eeb540e07a9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\videos\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_667", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\public\\videos\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\Public\\Pictures\\desktop.ini", "hashes": [ { "md5_hash": "84033410a1053c63dedc29d312a02fff", "sha1_hash": "a98610896d90d8323dc68135e79b714f585619b3", "sha256_hash": "120db3e5232d5ac034a29d84bbc28e14b7fd08333b515574643d086152052dbd", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\pictures\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_679", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\public\\pictures\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\Public\\Music\\desktop.ini", "hashes": [ { "md5_hash": "19df54bac0c5e64d04110ed7d79e8a14", "sha1_hash": "3bc9092919086b28b62ee2e0ce7096b7e43a9934", "sha256_hash": "e7b4f0156e9e228454ba99d32e680487e680c7c7996cf48709ab54a2f42feb38", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\music\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_691", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\public\\music\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\Public\\Libraries\\desktop.ini", "hashes": [ { "md5_hash": "14f972c6f596015135491f8d195c6999", "sha1_hash": "aa46c370e3f5d5119f63168eef8c897f1947eece", "sha256_hash": "7d0f57e87e3fe8795d13be2e4f2cf9d4a2c15afab4aa58929dbd517077ae520e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\libraries\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_703", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\public\\libraries\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\Public\\Downloads\\desktop.ini", "hashes": [ { "md5_hash": "334326f2445576654b881ca75881a12a", "sha1_hash": "2154f40bf4c4189c8d3e963b05c853e4f2df3b12", "sha256_hash": "70b9f46cd1678b6200e585463d78b91d07ae8ca9f254590fe1d5ce152f6f770a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\downloads\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_725", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\public\\downloads\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\Public\\Documents\\desktop.ini", "hashes": [ { "md5_hash": "fb9580698701e27432647edd2d7eaac7", "sha1_hash": "6781d39960831bab710c05f590166323646eb7da", "sha256_hash": "acce99a2039dd0fe6a4256f06e4ef93d4585828d8394bbb4aa8a4eca014888bc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\documents\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_737", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\public\\documents\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\Public\\Desktop\\desktop.ini", "hashes": [ { "md5_hash": "9dcef2ab01e7b4f41c0de6a3df60f5b4", "sha1_hash": "c685c2f13bbdc51b92da09c4382477e0aeec75af", "sha256_hash": "f3f0ac0332a1aadae365c1b4afca95d14e4fb89d56a47ba7582ca72d40aa1cb9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\desktop\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_761", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\public\\desktop\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\Public\\AccountPictures\\desktop.ini", "hashes": [ { "md5_hash": "efa39eb41053ff0a991c991975875bc0", "sha1_hash": "5d2c35f8ad96ecda5cebb27ea0f8885656c1038e", "sha256_hash": "5c4d71bd487cd675b674e5774c8cf24bdf86a8dd5204ec75693ea5960d20e216", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\public\\accountpictures\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_791", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\public\\accountpictures\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", "hashes": [ { "md5_hash": "bd3d4d5eb25d64e78a8dc21a5b0ce4c8", "sha1_hash": "5a860bd27a305d6e6af9b8d406836bcdbd0c3d46", "sha256_hash": "874beff6a5c1aa61d7c49a25dc23a22eb7b0aecf5cb5b45b455afb0f9d8b52f9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_1123", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\videos\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\nXLOUPBUSENPl3p-\\WnVoa3g9JP.avi", "hashes": [ { "md5_hash": "a937f1f839db02afb42d1607d1ded6e0", "sha1_hash": "3e0379560c88f8c49c9bf53d4a2567996f17b929", "sha256_hash": "4f33edcf69278ac37b940a4eda0741af35ba6b54d261723c27518704e82676f2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\nxloupbusenpl3p-\\wnvoa3g9jp.avi", "operations": [ "write" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_file_system", "category_desc": "File System", "operation": "_modify_user_files", "operation_desc": "Modify content of user files", "ref_gfncalls": [ { "ref_id": "gfn_1574", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_user_files", "technique_desc": "Modify the content of multiple user files. This is an indicator for an encryption attempt.", "technique_path": "built_in._file_system._modify_user_files.vmray_modify_user_files", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\nXLOUPBUSENPl3p-\\WnVoa3g9JP.avi..doc", "hashes": [ { "md5_hash": "a937f1f839db02afb42d1607d1ded6e0", "sha1_hash": "3e0379560c88f8c49c9bf53d4a2567996f17b929", "sha256_hash": "4f33edcf69278ac37b940a4eda0741af35ba6b54d261723c27518704e82676f2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\nxloupbusenpl3p-\\wnvoa3g9jp.avi..doc", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Videos\\bGVBhkL2p_r\\nXLOUPBUSENPl3p-\\WnVoa3g9JP.avi", "hashes": [ { "md5_hash": "a937f1f839db02afb42d1607d1ded6e0", "sha1_hash": "3e0379560c88f8c49c9bf53d4a2567996f17b929", "sha256_hash": "4f33edcf69278ac37b940a4eda0741af35ba6b54d261723c27518704e82676f2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\videos\\bgvbhkl2p_r\\nxloupbusenpl3p-\\wnvoa3g9jp.avi", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_file_system", "category_desc": "File System", "operation": "_rename_user_files", "operation_desc": "Rename user files", "ref_gfncalls": [ { "ref_id": "gfn_1581", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_rename_user_files", "technique_desc": "Rename multiple user files. This is an indicator for an encryption attempt.", "technique_path": "built_in._file_system._rename_user_files.vmray_rename_user_files", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Searches\\desktop.ini", "hashes": [ { "md5_hash": "c4c1f7faeaa84afea0455e3ad7466095", "sha1_hash": "f53b0cc38d4f8c6b30926e357e63d6cbe5d5166b", "sha256_hash": "7fc129f00a30303e0fae704350f13d9534be76909e6961261677e3b75d960a80", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\searches\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_1757", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\searches\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\desktop.ini", "hashes": [ { "md5_hash": "d2c3bc6c2e874a4e62d5752742d6a26c", "sha1_hash": "fca1d2e592d8698781d386f7ce2d310384c5853f", "sha256_hash": "2268250d88125d513d73334d7ecfd5c0ec075c5639646ac99e17bf8220e96c67", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\saved games\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_1791", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\saved games\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", "hashes": [ { "md5_hash": "3dbf9c15339199ca1e20853ace4b31d4", "sha1_hash": "c9b06d0f911c553a516f1e3066fcd1f3af08a473", "sha256_hash": "4d8b6c410fde466c6a91419bd42ff117b20a0142ecbf655f2b5c7e18e2b30157", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_1827", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\pictures\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", "hashes": [ { "md5_hash": "b0d042871f93477b4b37c70d7629837d", "sha1_hash": "66ef0c636edc9f29d4ccf63034dc37e8ebf88ec4", "sha256_hash": "af01d088ccd7258d620311b66d6308413f9a5b618df0a162b66461913890d241", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_1921", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", "hashes": [ { "md5_hash": "5cca10bd6c111274005acf6f8db9d76b", "sha1_hash": "8ab4945701ba3219e2ffdb58726d345c4dd79d48", "sha256_hash": "bd7dadad415f1e07336a09ada99a12632c47dcf7fb5a6de72ab9eaa5044856ef", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_2089", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\desktop.ini", "hashes": [ { "md5_hash": "0072fd5678c831e896556403c9a56dc5", "sha1_hash": "e5f5c7cf7b6d6e5ae349dfb6fb2f02f95130a79c", "sha256_hash": "cc05acaabf026ed6bcd29908ae5079735617583855e4fd6557d8e310154af02e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\onedrive\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_2399", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\onedrive\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", "hashes": [ { "md5_hash": "c97099a5ebbc80d50d309d865880682c", "sha1_hash": "4ca5f47e27d62693879f719b542b2904b0563b56", "sha256_hash": "ad3c0c99182392975db23272978191ff9571c70e703c03a405338a777fc58be2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_2435", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\music\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Links\\desktop.ini", "hashes": [ { "md5_hash": "2dd61f65d7d549f0564ae374b7bdc10d", "sha1_hash": "a7d6c597f67bedbce0b7d4843a274574e9f14ebe", "sha256_hash": "4a5b08ec17f9054b0cbb823f51431fc0ee45bcd530e1ede13945052efce215af", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\links\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_2989", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\links\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Favorites\\desktop.ini", "hashes": [ { "md5_hash": "8e72f402d6f32a2eb8b40ef2bf09d134", "sha1_hash": "4997f213a0a8f74565d3d4a6411ee74ed5d370d5", "sha256_hash": "4f7b953408cc9936a382ff90102cbc50db2625cab0d8d017a81caa4b8132ecb5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_3043", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\favorites\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\desktop.ini", "hashes": [ { "md5_hash": "e4dd0769eed2ff53c7a6d53383848aec", "sha1_hash": "ab6991ca91766ffa6a1c1c85d373eb2ba58b687c", "sha256_hash": "72a735d2fd20e5eb2909a8a433c0e3155452df4ea83b7c9dc43775144053c7b5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\favorites\\links\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_3053", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\favorites\\links\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", "hashes": [ { "md5_hash": "a366561c12c6f69711d3bb85e052fa7d", "sha1_hash": "c70b3c04a93e561b4cf463ac44d10923da75566f", "sha256_hash": "b1422698d4c21483ab1bd86344784727cad570b0b0b1eeaef1f221496e685910", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\downloads\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_3213", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\downloads\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", "hashes": [ { "md5_hash": "7132d3a594fda47d039273bbc40dbffd", "sha1_hash": "860a7d33a834d69fcc947226d561d6ca7c1440bb", "sha256_hash": "b9b2bd048b7ee2b23a488b39c36a49d1a453087428ae56f7f43624b1658624bc", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_3527", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\documents\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", "hashes": [ { "md5_hash": "b7ba30f52e6052a678f9b39e7f965d17", "sha1_hash": "f8efb0bfbdbc55f85ac8c41a76888c1ffcb833c7", "sha256_hash": "4fb0d86f57dc9ce54ad774b2f8d42292f226f3af462a56b2a8ad6bb0dd670c53", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_4313", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\documents\\my shapes\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", "hashes": [ { "md5_hash": "1303831f18dffd4cf7f31ee7c7682dc9", "sha1_hash": "af7733df345ddf40bce6ff8799b0ebbfd06c2e62", "sha256_hash": "032970cd060cdf8c701de88534b813f7b69277ce8ae5be1f12f8363b387bcfe7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_4568", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\desktop\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Users\\CIiHmnxMn6Ps\\Contacts\\desktop.ini", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\contacts\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_5058", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\users\\ciihmnxmn6ps\\contacts\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_read_from_remote_process", "operation_desc": "Read from memory of another process", "ref_gfncalls": [ { "ref_id": "gfn_12534", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_read_from_remote_process", "technique_desc": "\"c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vworbzlbc.exe\" reads from \"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vwOrbzLbc.exe\".", "technique_path": "built_in._process._read_from_remote_process.vmray_read_from_remote_process", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [ { "filename": "C:\\Program Files (x86)\\desktop.ini", "hashes": [], "norm_filename": "c:\\program files (x86)\\desktop.ini", "operations": [ "access" ], "type": "file_artifact", "version": 1 } ], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_masquerade", "category_desc": "Masquerade", "operation": "_change_folder_appearance", "operation_desc": "Change folder appearance", "ref_gfncalls": [ { "ref_id": "gfn_34001", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_change_folder_appearance", "technique_desc": "Folder \"c:\\program files (x86)\" has a changed appearance.", "technique_path": "built_in._masquerade._change_folder_appearance.vmray_change_folder_appearance", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_file_system", "category_desc": "File System", "operation": "_create_many_files", "operation_desc": "Create many files", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_create_many_files", "technique_desc": "Create above average number of files.", "technique_path": "built_in._file_system._create_many_files.vmray_create_many_files", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_file_system", "category_desc": "File System", "operation": "_handle_with_malicious_files", "operation_desc": "Handle with malicious files", "ref_gfncalls": [], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_handle_with_malicious_files", "technique_desc": "File \"c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe\" is a known malicious file.", "technique_path": "built_in._file_system._handle_with_malicious_files.vmray_handle_with_malicious_files", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_control_flow_non_system", "operation_desc": "Modify control flow of a process running from a created or modified executable", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_control_flow_non_system", "technique_desc": "\"c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe\" alters context of \"c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe\"", "technique_path": "built_in._injection._modify_control_flow_non_system.vmray_modify_control_flow_non_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_control_flow_non_system", "operation_desc": "Modify control flow of a process running from a created or modified executable", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_control_flow_non_system", "technique_desc": "\"c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vworbzlbc.exe\" alters context of \"c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vworbzlbc.exe\"", "technique_path": "built_in._injection._modify_control_flow_non_system.vmray_modify_control_flow_non_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_download_data", "operation_desc": "Download data", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_download_data_http_request", "technique_desc": "URL \"http://rorymartin8.info/hudgy356?\".", "technique_path": "built_in._network._download_data.vmray_download_data_http_request", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_pe", "category_desc": "PE", "operation": "_drop_pe_file", "operation_desc": "Drop PE file", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_drop_pe_file", "technique_desc": "Drop file \"c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe\".", "technique_path": "built_in._pe._drop_pe_file.vmray_drop_pe_file", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_pe", "category_desc": "PE", "operation": "_drop_pe_file", "operation_desc": "Drop PE file", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_drop_pe_file", "technique_desc": "Drop file \"c:\\users\\ciihmn~1\\appdata\\local\\temp\\nsma14e.tmp\\system.dll\".", "technique_path": "built_in._pe._drop_pe_file.vmray_drop_pe_file", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_pe", "category_desc": "PE", "operation": "_execute_dropped_pe_file", "operation_desc": "Execute dropped PE file", "ref_gfncalls": [], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_execute_dropped_pe_file", "technique_desc": "Execute dropped file \"c:\\users\\ciihmn~1\\appdata\\local\\temp\\vworbzlbc.exe\".", "technique_path": "built_in._pe._execute_dropped_pe_file.vmray_execute_dropped_pe_file", "type": "vti_rule_match", "version": 1 } ], "vti_rule_type": "Scripts", "vti_score": 100 }, "yara": { "apply_yara": true, "apply_yara_on_created_files": true, "apply_yara_on_modified_files": true, "apply_yara_on_pcap_file": true, "apply_yara_on_process_dumps": true, "apply_yara_on_sample_files": true, "match_count": 0, "matches": [], "ruleset_count": 7, "type": "yara", "version": 1 } }